Skip to content

[SEC-002] Broken Authentication - JWT algorithm is not whitelisted

Description

Algorithm of JWT is not whitelisted. This may be causing serious severity. User may use JWT algorithm none. Below the example of bad token:

eyJhbGciOiJub25lIiwidHlwIjoiand0In0.eyJlbWFpbCI6IjEzNTIwMTI4QHN0ZC5zdGVpLml0Yi5hYy5pZCIsIm5hbWUiOiJCYXl1IFNhbXVkcmEgICIsInJvbGUiOiJ1c2VyIiwidXNlcl9pZCI6IjEiLCJ1c2VybmFtZSI6ImJheXVzYW11ZHJhIiwidHlwZSI6InJlZnJlc2giLCJpYXQiOjE2OTc4MDM0MDcsImV4cCI6MTY5NzgxNDIwN30.

Above JWT code decoded as:

{
  "alg": "none",
  "typ": "jwt"
}.
{
  "email": "13520128@std.stei.itb.ac.id",
  "name": "Bayu Samudra  ",
  "role": "user",
  "user_id": "1",
  "username": "bayusamudra",
  "type": "refresh",
  "iat": 1697803407,
  "exp": 1697814207
}

With none algorithm, the attacker able to build an unsigned JWT that is accepted by application.

Severity

This bug has severity CRITICAL

Affected URL

  • All of URL that used validateToken

Attachment

image