Comments (4)
Thank you for your reporting.
I'll review it.
from clj-jwt.
:none algorithm
Most (hopefully all?) implementations now have a basic check to prevent this attack: if a secret key was provided, then token verification will fail for tokens using the none algorithm.
Currently, clj-jwt does not allows to specify key to verify not signed token (:none
algorithm).
- code
Line 57 in 63244e4
:RS256 / :ES256 -> :HS256
clj-jwt handles public key as an object of bouncycastle, so verifying :HS256
signed token with RSA public key will fail.
Test codes
I tested clj-jwt codes with following test case and it is not vulnerable.
(ns clj-jwt.attack-test
(:require
[clj-jwt.core :refer :all]
[clj-jwt.sign :refer :all]
[clj-jwt.key :refer [private-key public-key]]
[clojure.string :as str]
[clojure.test :refer :all]))
(def pub-key-path "test/files/rsa/no_pass.pub.key")
(def rsa-prv-key (private-key "test/files/rsa/no_pass.key"))
(def rsa-pub-key (public-key pub-key-path))
(deftest test-algorithm->none-attack
(let [key "secret"
original (-> {:foo "bar"} jwt (sign :HS256 key))
attacked (update-in original [:header :alg] (constantly "none"))]
(is (verify original key))
(is (not (verify attacked key)))))
(deftest test-rsa->hmac-attack
(let [base (jwt {:foo "bar"})
original (sign base :RS256 rsa-prv-key)
hmac-sign (-> base (sign :HS256 (str/trim (slurp pub-key-path))) :signature)
attacked (-> original
(update-in [:header :alg] (constantly "HS256"))
(update-in [:signature] (constantly hmac-sign)))]
(is (verify original rsa-pub-key))
(is (thrown? Exception (verify attacked rsa-pub-key)))))
ToDo
- Add optional parameter that specifies
algorithm
to verify algorithm in token header.
from clj-jwt.
Great work @liquidz :)
from clj-jwt.
ToDo
- Add optional parameter that specifies algorithm to verify algorithm in token header.
I supported this optional parameter in ver 0.0.13.
https://clojars.org/clj-jwt/versions/0.0.13
from clj-jwt.
Related Issues (18)
- Support X.509 public key
- `public-key-from-string` throws NullPointerException on invalid key HOT 1
- No implementation of method :init for class JWT HOT 2
- Support for decoding tokens HOT 2
- exception using cipher - please check password and data HOT 3
- decode HMAC256 signed token HOT 2
- Handling of Clojure maps in JWT claims
- str->jwt throws exceptions HOT 1
- Problem `NoClassDefFoundError` for class `Encodable` from bouncycastle.
- Process for generating ES512 keys? HOT 3
- IllegalArgumentException No matching method found: initVerify for class java.security.Signature$Delegate clojure.lang.Reflector.invokeMatchingMethod (Reflector.java:80)
- JWT key names an clj-jwt
- Same iat for multiple requests
- date values for :exp :nbf and :iat are divided by 1000? HOT 3
- Claims containing URI String keys cannot be verified. HOT 5
- Use constant time comparison when verifying signatures HOT 1
- Using a secret key to verify an unsigned token returns true, probable security issue HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from clj-jwt.