feat: implement header param injection handling for JWT vulnerabilities #473

leiberbertel · 2024-08-19T03:36:49Z

Added handling for header parameter injection in JWTVulnerability.java, addressing the missing attack vector noted in issue #413. Follows https://portswigger.net/web-security/jwt guidelines.

Ref: #413

preetkaran20 · 2024-08-24T04:16:33Z

src/main/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerability.java

+    public ResponseEntity<GenericVulnerabilityResponseBean<String>> getHeaderInjectionVulnerability(
+            HttpServletRequest request) {
+        String headerValue = request.getHeader("User-Defined-Header");
+        if (headerValue != null && headerValue.contains("malicious")) {


@leiberbertel I think this is not the right way to implement the header param injection. The real vulnerability is with optional headers like JWK or KID or JKU as implemention of library will start relying on the data provided as part of these headers for verifying signature.

Having custom/user defined headers is not wrong or considered malicious.

A simple attack is say JWT library is relying on the public key provided as part of JWK header instead of validating the public key provided with the whitelisted public key set. so attack would be a malicious user will generate key pairs and sign the jwt with its own private key and passed public key as JWK header. The backend will not validate public key against a whitelist and start relying on provided public key to validate the JWT.

Hi @preetkaran20,
I really appreciate your detailed review and the points you highlighted. I completely agree that attacks via headers such as JWK, KID or JKU pose a significant threat, especially when the implementation does not properly validate public keys against a trusted set.

My intent with the current implementation was to demonstrate how user-defined headers can be manipulated, but I see that focusing on these critical headers such as JWK could provide a more realistic and educational example of common vulnerabilities in JWTs.

I will revise the implementation to incorporate these examples, ensuring that we clearly demonstrate how the lack of proper validation of public keys can be exploited.

Regards.

preetkaran20 · 2024-08-24T04:17:04Z

src/main/resources/static/vulnerableApp.js

@@ -245,6 +245,11 @@ function doGetAjaxCall(callBack, url, isJson) {
    "Content-Type",
    isJson ? "application/json" : "text/html"
  );
+
+  for (const header in headers) {


Thanks for this change.

preetkaran20 · 2024-09-29T06:01:10Z

build.gradle

@@ -150,14 +150,19 @@ dependencies {
    implementation group: 'org.json', name: 'json', version: '20190722'

 	//https://mvnrepository.com/artifact/com.nimbusds/nimbus-jose-jwt
-    implementation group: 'com.nimbusds', name: 'nimbus-jose-jwt', version: '8.3'
+    implementation group: 'com.nimbusds', name: 'nimbus-jose-jwt', version: '9.31'


please validate that it is backward compatible. Try to test other levels of JWT vulnerability,

I have validated the other JWT vulnerabilities and they work correctly, ensuring that they stay within the expected parameters.

Thank you !!! ❤️

preetkaran20 · 2024-09-29T06:01:25Z

build.gradle


    // https://mvnrepository.com/artifact/commons-io/commons-io
    implementation group: 'commons-io', name: 'commons-io', version: '2.7'

    implementation group: 'io.github.sasanlabs', name: 'facade-schema', version: '1.0.1'

    implementation group: 'commons-fileupload', name: 'commons-fileupload', version: '1.5'
+
+    // https://mvnrepository.com/artifact/com.auth0/java-jwt
+    implementation group: 'com.auth0', name: 'java-jwt', version: '4.2.1'


Do we need this version?

Currently, I have added java-jwt version 4.2.1 as it is compatible with the project dependencies and the version of Java 8 we are using. I have found no conflicts with other libraries, but I may upgrade to the latest 4.4.0 version to ensure we have the latest fixes and enhancements. Is it okay with you if I make the change?

I think we don't need this as we already have nimbus-jose-jwt

Thanks for pointing that out, I hadn't considered that nimbus-jose-jwt already covers the functionality needed to handle JWTs. I reviewed my implementation and indeed, it looks like we can dispense with java-jwt and just use nimbus-jose-jwt. I will proceed to remove the java-jwt dependency and adjust the code to work with nimbus-jose-jwt.

Please let me know once you have done the changes, we can go ahead with the merging of the PR.

All ready, we can continue:)

preetkaran20 · 2024-09-29T06:03:03Z

src/main/java/org/sasanlabs/service/vulnerability/sampleVulnerability/SampleVulnerability.java

+import org.sasanlabs.vulnerability.types.VulnerabilityType;
+import org.springframework.web.bind.annotation.RequestParam;
+
+/**


please remove samplevulnerability related code.

Thanks, I have already removed it

I can still see these. can you please push the changes.

Yes of course, please give me a few hours and I'll upload it. Thanks

preetkaran20 · 2024-09-29T06:05:19Z

src/main/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerability.java

+    public ResponseEntity<GenericVulnerabilityResponseBean<String>> getHeaderInjectionVulnerability(
+            HttpServletRequest request) {
+        String jwtToken = request.getHeader("Authorization");
+        if (jwtToken == null || !jwtToken.startsWith("Bearer ")) {


better create a constant for "Bearer" in constants.

Thanks, I have implemented the improvement

preetkaran20 · 2024-09-29T06:06:09Z

src/main/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerability.java

+                    HttpStatus.BAD_REQUEST);
+        }
+
+        jwtToken = jwtToken.substring(7); // Remove "Bearer " prefix


I think it is better to replace bearer from token instead of index substring.

Thanks, I have implemented the improvement

preetkaran20 · 2024-09-29T06:09:20Z

src/main/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerability.java

+
+    @AttackVector(
+            vulnerabilityExposed = VulnerabilityType.HEADER_INJECTION,
+            description = "HEADER_INJECTION_VULNERABILITY_EXAMPLE")


please update the Locale Key for description.

Thanks, I have updated it

preetkaran20 · 2024-09-29T06:13:44Z

src/main/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerability.java

+    @VulnerableAppRequestMapping(
+            value = LevelConstants.LEVEL_13,
+            htmlTemplate = "LEVEL_13/HeaderInjection_Level13")
+    public ResponseEntity<GenericVulnerabilityResponseBean<String>> getHeaderInjectionVulnerability(


Sorry but there is a Level9 which has JWK based vulnerability.
How about converting it into a secure level as an extension of level 9 where we always validate JWK header against a set of public keys and only allow if it is part of them ?

@leiberbertel it is fine to have another vulnerability with same functionality as well.

I understand, thanks for the confirmation:).

…pendency and update messages

leiberbertel · 2024-10-03T01:24:18Z

@preetkaran20, I hope you are well, thanks for your patience! I wanted to consult you if it would be possible for me to upload some unit tests for the level I created. If so, I can create the card, or if you prefer, you could do it.

I remain attentive to your answer.

preetkaran20 · 2024-11-10T01:00:42Z

@preetkaran20, I hope you are well, thanks for your patience! I wanted to consult you if it would be possible for me to upload some unit tests for the level I created. If so, I can create the card, or if you prefer, you could do it.

I remain attentive to your answer.

@leiberbertel It is upto you. I am fine with everything.

leiberbertel · 2024-11-10T04:10:04Z

@preetkaran20, I hope you are well, thanks for your patience! I wanted to consult you if it would be possible for me to upload some unit tests for the level I created. If so, I can create the card, or if you prefer, you could do it.
I remain attentive to your answer.

@leiberbertel It is upto you. I am fine with everything.

@preetkaran20 Okay, in that case, I'll upload the changes.

leiberbertel added 3 commits August 18, 2024 22:34

feat: implement header param injection handling for JWT vulnerabilities

0c23ff9

apply spotless

4812d61

apply spotless again

262afac

preetkaran20 self-requested a review August 19, 2024 17:19

preetkaran20 reviewed Aug 24, 2024

View reviewed changes

leiberbertel added 2 commits September 28, 2024 17:51

fix: modified to meet requirements

ebcae74

style: apply spotless

be4751a

preetkaran20 reviewed Sep 29, 2024

View reviewed changes

fix: Maintain implementation so as not to be dependent on external de…

b7cea19

…pendency and update messages

leiberbertel added 3 commits November 10, 2024 00:27

chore: removes unnecessary dependence

672b4ea

refactor: removes unnecessary import

324fa33

refactor: remove boilerplate

261ea39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: implement header param injection handling for JWT vulnerabilities #473

feat: implement header param injection handling for JWT vulnerabilities #473

leiberbertel commented Aug 19, 2024

preetkaran20 Aug 24, 2024 •

edited

Loading

leiberbertel Sep 4, 2024

preetkaran20 Aug 24, 2024

preetkaran20 Sep 29, 2024

leiberbertel Sep 29, 2024

preetkaran20 Sep 29, 2024

preetkaran20 Sep 29, 2024

leiberbertel Sep 29, 2024

preetkaran20 Sep 29, 2024

leiberbertel Sep 29, 2024

preetkaran20 Nov 10, 2024

leiberbertel Nov 10, 2024

preetkaran20 Sep 29, 2024

leiberbertel Sep 29, 2024

preetkaran20 Oct 2, 2024

leiberbertel Oct 2, 2024

preetkaran20 Sep 29, 2024

leiberbertel Sep 29, 2024

preetkaran20 Sep 29, 2024

leiberbertel Sep 29, 2024

preetkaran20 Sep 29, 2024

leiberbertel Sep 29, 2024

preetkaran20 Sep 29, 2024 •

edited

Loading

preetkaran20 Sep 29, 2024

leiberbertel Sep 29, 2024

leiberbertel commented Oct 3, 2024

preetkaran20 commented Nov 10, 2024

leiberbertel commented Nov 10, 2024 •

edited

Loading

feat: implement header param injection handling for JWT vulnerabilities #473

Are you sure you want to change the base?

feat: implement header param injection handling for JWT vulnerabilities #473

Conversation

leiberbertel commented Aug 19, 2024

preetkaran20 Aug 24, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

preetkaran20 Sep 29, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

leiberbertel commented Oct 3, 2024

preetkaran20 commented Nov 10, 2024

leiberbertel commented Nov 10, 2024 • edited Loading

preetkaran20 Aug 24, 2024 •

edited

Loading

preetkaran20 Sep 29, 2024 •

edited

Loading

leiberbertel commented Nov 10, 2024 •

edited

Loading