Critical vulnerabilities in JSON Web Token libraries about clj-jwt

[liquidz]

Thank you for your reporting.
I'll review it.

[liquidz]

:none algorithm

Most (hopefully all?) implementations now have a basic check to prevent this attack: if a secret key was provided, then token verification will fail for tokens using the none algorithm.

Currently, clj-jwt does not allows to specify key to verify not signed token (:none algorithm).

• code

  • clj-jwt/src/clj_jwt/core.clj

    Line 57 in 63244e4

    (assoc-in this [:header :alg] (name alg)))

:RS256 / :ES256 -> :HS256

clj-jwt handles public key as an object of bouncycastle, so verifying :HS256 signed token with RSA public key will fail.

Test codes

I tested clj-jwt codes with following test case and it is not vulnerable.

(ns clj-jwt.attack-test
  (:require
    [clj-jwt.core   :refer :all]
    [clj-jwt.sign   :refer :all]
    [clj-jwt.key    :refer [private-key public-key]]
    [clojure.string :as str]
    [clojure.test   :refer :all]))

(def pub-key-path "test/files/rsa/no_pass.pub.key")
(def rsa-prv-key  (private-key "test/files/rsa/no_pass.key"))
(def rsa-pub-key  (public-key  pub-key-path))

(deftest test-algorithm->none-attack
  (let [key "secret"
        original (-> {:foo "bar"} jwt (sign :HS256 key))
        attacked (update-in original [:header :alg] (constantly "none"))]
    (is (verify original key))
    (is (not (verify attacked key)))))

(deftest test-rsa->hmac-attack
  (let [base      (jwt {:foo "bar"})
        original  (sign base :RS256 rsa-prv-key)
        hmac-sign (-> base (sign :HS256 (str/trim (slurp pub-key-path))) :signature)
        attacked  (-> original
                      (update-in [:header :alg] (constantly "HS256"))
                      (update-in [:signature]   (constantly hmac-sign)))]
    (is (verify original rsa-pub-key))
    (is (thrown? Exception (verify attacked rsa-pub-key)))))

ToDo

1. Add optional parameter that specifies algorithm to verify algorithm in token header.

[donbonifacio]

Great work @liquidz :)

[liquidz]

ToDo

1. Add optional parameter that specifies algorithm to verify algorithm in token header.

I supported this optional parameter in ver 0.0.13.

https://clojars.org/clj-jwt/versions/0.0.13