JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

CVE-2023-22644

Summary

The vulnerability allows an attacker to reverse engineer the JSON Web Token (JWT) utilized in the authentication process for Manager and API access in NeuVector. By successfully forging a valid NeuVector token, an unauthorized user could engage in harmful activities, potentially leading to remote code execution. This exploitation poses significant risks to the integrity and security of deployment environments that rely on NeuVector.

References