From the Solid gitter: a review paper of vulnerabilities. “On The (In-)Security Of JavaScript Object Signing And Encryption” Detering et. al https://www.ei.rub.de/media/ei/veroeffentlichungen/2017/10/17/main.pdf
ABSTRACT
JavaScript Object Notation (JSON) has evolved to the de-facto stan-
dard file format in the web used for application configuration,
cross- and same-origin data exchange, as well as in Single Sign-
On (SSO) protocols such as OpenID Connect. To protect integrity,
authenticity, and confidentiality of sensitive data, JavaScript Object
Signing and Encryption (JOSE) was created to apply cryptographic
mechanisms directly in JSON messages.
We investigate the security of JOSE and present different appli-
cable attacks on several popular libraries. We introduce JOSEPH
(JavaScript Object Signing and Encryption Pentesting Helper) –
our newly developed Burp Suite extension, which automatically
performs security analysis on targeted applications. JOSEPH’s au-
tomatic vulnerability detection ranges from executing simple signa-
ture exclusion or signature faking techniques, which neglect JSON
message integrity, up to highly complex cryptographic Bleichen-
bacher attacks, breaking the confidentiality of encrypted JSON
messages. We found severe vulnerabilities in six popular JOSE li-
braries. We responsibly disclosed all weaknesses to the developers
and helped them to provide fixes