JWT Vulnerabilities
JSON Web Tokens (JWTs) are a popular standard for representing claims between two parties. However, improper implementation of JWT verification can lead to several critical security vulnerabilities.
JWTop provides built-in tools to test for these vulnerabilities automatically or manually.
Common Vulnerabilities
Section titled “Common Vulnerabilities” None Algorithm Accepting tokens with no signature.
Blank Secret Tokens signed with an empty HMAC secret.
HMAC Confusion Using a public key as an HMAC secret.
KID Injection Injecting payloads via the Key ID header.
JWK Header Injection Trusting a self-signed public key embedded in the token.
JKU Header Injection Fetching and trusting a JWKS from an attacker-controlled URL.
X5C Header Injection Trusting a self-signed certificate embedded in the token.
X5U Header Injection Fetching and trusting a certificate from an attacker-controlled URL.
Null Signature Stripping the signature from the token.
Psychic Signature ECDSA verifiers accepting an all-zero (r=0, s=0) signature.
Weak Secret Brute-forcing common HMAC secrets.
Signature Not Verified Bypassing signature verification entirely.
Cross Service Relay Attack Relaying tokens from other projects.
How to Test
Section titled “How to Test”The fastest way to test a live server for all these vulnerabilities at once is to use the crack command:
jwtop crack $TOKEN --url https://api.example.com/protectedFor more details on each vulnerability, click on the cards above.