JWT X5U Header Injection
| Severity | High |
|---|---|
| Classifications | |
| OWASP Category | OWASP API2:2023 Broken Authentication |
The “JWT X5U Header Injection” vulnerability occurs when a server reads the x5u (X.509 URL) header from an incoming token, fetches the certificate at that URL, and uses it to verify the signature without checking that it chains to a trusted CA. Because the attacker controls the header, they can point x5u at a server they own that serves an attacker-generated certificate. This is also a Server-Side Request Forgery primitive.
For more details, you can refer to the jwtop documentation on X5U Injection.
Example
Section titled “Example”- The attacker hosts a self-signed certificate for a key pair they generated.
- They build a token with the desired claims and a header
"x5u": "https://attacker.example/cert.pem". - They sign it with the matching private key.
- The server fetches the attacker’s certificate, verifies the signature against it, and accepts the token.
How to test?
Section titled “How to test?”If you want to test only the “JWT X5U Header Injection” vulnerability, you can use the following command:
vulnapi scan curl [url] -H "Authorization: Bearer [JWT]" --scans jwt.x5u_injectionecho "[JWT]" | vulnapi scan openapi [OpenAPI_Path_Or_URL] --scans jwt.x5u_injectionvulnapi scan graphql -H "Authorization: Bearer [JWT]" --scans jwt.x5u_injection [url]This check requires a live target that can reach a callback server run by the scanner, so it only runs when the token uses an asymmetric algorithm and a reachable callback address has been configured.
VulnAPI supports scanning against various types of other vulnerabilities as well.
What is the impact?
Section titled “What is the impact?”- Full Authentication Bypass: An attacker can forge tokens for any user, including administrative accounts.
- Server-Side Request Forgery: The target can be coerced into making outbound requests to attacker-chosen URLs.
- Account Takeover: Impersonating any user in the system.
How to remediate?
Section titled “How to remediate?”- Ignore token-supplied URLs: Never fetch keys or certificates from the
x5uorjkuheader. Use a certificate configured out of band. - Allowlist endpoints: If dynamic retrieval is required, validate
x5uagainst a strict allowlist of known, trusted URLs and verify the certificate chains to a pinned CA. - Strict Algorithm Enforcement: Always pin the expected algorithm(s) when verifying a JWT.