In APache APISIX before 3.13.1, an attacker can obtain a plugin-configured secret via an error message response by sending an incorrect JSON Web Token to a route protected by the jwt-auth plugin. The error logic in the dependency library lua-resty-jwt enables sending an RS256 token to an endpoint that requires an HS256 token, with the original secret value included in the error response.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-29266
• https://lists.apache.org/thread/6qpfyxogbvn18g9xr8g218jjfjbfsbhr
• http://www.openwall.com/lists/oss-security/2022/04/20/1