Critical Vulnerabilities in JSON Web Token Libraries

For those of you concerned about if a JWT library you're using is vulnerable, you can see the current list of verified/validate clients for each language here: http://jwt.io/ (page down to see the list)

My team has been using ruby-jwt, so I'm glad to see that at least does not seem to be on the list of vulnerable libraries.

Re: Critical Vulnerabilities in JSON Web Token Libraries

#6

Post by ploxiln » Wed, Apr 01, 2015, 6:15 AM UTC

bbrazil wrote: post #3

Be wary if you do anything with signed data before you verify the signature. http://www.thoughtcrime.org/blog/the-cryptographic-doom-prin...

That's a great link (which I've seen before) and I upvoted it.

But these "typical JWT lib api vulns" are WAY SIMPLER than Vaudenay etc. Any programmer could do this in minutes or less. WOW. It's so obvious and straightforward (in hindsight I suppose). My mouth is still hanging open.

Re: Critical Vulnerabilities in JSON Web Token Libraries

#7

Post by mfjordvald » Wed, Apr 01, 2015, 6:19 AM UTC

They list the php-jwt library from firebase as vulnerable but I can't see why. As far as I can see they do not support the None algorithm.

https://github.com/firebase/php-jwt/blob/master/Authenticati...

It's not in the methods array and the decode method specifically does a check to see if it's empty.

if (empty($header->alg)) { throw exception }

Can anyone throw some light on this?

Re: Critical Vulnerabilities in JSON Web Token Libraries

#8

Post by ploxiln » Wed, Apr 01, 2015, 6:26 AM UTC

mfjordvald wrote: post #7

They list the php-jwt library from firebase as vulnerable but I can't see why. As far as I can see they do not support the None algorithm. https://github.com/firebase/php-jwt/blob/master/Authenticati... It's not in the methods array and the decode method specifically does a check to see if it's empty. if (empty($header->alg)) { throw exception } Can anyone throw some light on this?

The second critical problem, which is not addressed by php-jwt, is that it does not take as a parameter to the decode() function which algorithm should be used. It figures out the algorithm by looking at the header.

As the original post describes, if your code expected to use a RSA public/private key pair, then it will pass the public key to decode(). Then an attacker can craft a JWT that claims to use a HMAC symmetric key and sign it with the public key, which is public. One and done.

(your code in that case expected the header to specify an RSA algorithm, and be signed with the private key. but the decode() function doesn't know that)

Re: Critical Vulnerabilities in JSON Web Token Libraries

#9

Post by mfjordvald » Wed, Apr 01, 2015, 6:39 AM UTC

ploxiln wrote: post #8

mfjordvald wrote: post #7

They list the php-jwt library from firebase as vulnerable but I can't see why. As far as I can see they do not support the None algorithm. https://github.com/firebase/php-jwt/blob/master/Authenticati... It's not in the methods array and the decode method specifically does a check to see if it's empty. if (empty($header->alg)) { throw exception } Can anyone throw some light on this?

The second critical problem, which is not addressed by php-jwt, is that it does not take as a parameter to the decode() function which algorithm should be used. It figures out the algorithm by looking at the header. As the original post describes, if your code expected to use a RSA public/private key pair, then it will pass the public key to decode(). Then an attacker can craft a JWT that claims to use a HMAC symmetr…

Cheers, so using this library only to encode should not be an issue for us.

Re: Critical Vulnerabilities in JSON Web Token Libraries

#10

Post by odino » Wed, Apr 01, 2015, 7:25 AM UTC

By the way, claps for Tim for the amazing job. He contacted various people and gave them heads up weeks ago. I think the wat this was handled was awesome.

<3 OSS