Covered by FixVibehigh

. JWT Trygd: Váði fyri ótryggjaðum merkjum og vantandi kravváttan ZXCVFIXVIBESEND ZXCVFIXVIBESEG1. Óhóskandi JWT umsiting, so sum at góðtaka 'none' algoritmuna ella ikki at validera 'exp' og 'aud' pástandir, kann føra til sannroyndarkoyring. ZXCVFIXVIBESEND ZXCVFIXVIBESEG2. JSON Web Tokens (JWTs) geva ein standard fyri at flyta krav, men trygdin byggir á neyva validering. Um ikki staðfest undirskriftir, útgingin tíðir ella ætlaðar áhoyrarar, kunnu álopsmenn umganga sannroynd ella endurtaka tokens. ZXCVFIXVIBESEND ZXCVFIXVIBESEG3. ## Álopsfólkaávirkan ZXCVFIXVIBESEND ZXCVFIXVIBESEG4. Óhóskandi ZXCVFIXVIBETOKEN4ZXCV-validering ger, at álopsfólk kunnu umganga sannroyndarmekanismur við at falsa pástandir ella endurnýta útgingin tokens ZXCVFIXVIBETOKEN1ZXCV. Um ein ambætari tekur ímóti tokens uttan gylduga undirskrift, kann ein álopsmaður broyta nyttulastina til at eskalera rættindini ella gera seg inn á ein og hvønn brúkara ZXCVFIXVIBETOKEN2ZXCV. Harumframt loyvir ein álopsmaður ikki at umsita útgingin krav (JWT) at brúka eitt kompromitterað token í óavmarkaðan mun. ZXCVFIXVIBESEND ZXCVFIXVIBESEG5. ## Rótorsøk ZXCVFIXVIBESEND ZXCVFIXVIBESEG6. Eitt JSON vevmerki (ZXCVFIXVIBETOKEN1ZXCV) er ein JSON-baseraður bygnaður, sum verður brúktur til at umboða pástandir, sum eru talgilt undirskrivaðir ella integritetsvardir. Trygdarbrek stava vanliga frá tveimum høvuðsumsitingarbilum: ZXCVFIXVIBESEND ZXCVFIXVIBESEG7. 1. Góðtøka av ótryggum JWT: Um ein tænasta ikki strangt umsitur undirskriftarváttan, kann hon viðgera "Ótryggjaðar JWT", har undirskriftin er burturstaddur og algoritman er sett til "eingin" JWT. Í hesum førinum hevur ambætarin álit á pástandunum í nyttulastini uttan at staðfesta teirra integritet ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG8. 2. Manglandi kravváttan: Kravið JWT (útgingin tíð) eyðmerkir tíðina á ella eftir, sum ZXCVFIXVIBETOKEN5ZXCV ikki skal góðtakast til viðgerð av ZXCVFIXVIBETOKEN2ZXCV. Kravið ZXCVFIXVIBETOKEN1ZXCV (áhoyrarar) eyðmerkir ætlaðu móttakararnar av merkinum ZXCVFIXVIBETOKEN3ZXCV. Um hesi ikki eru merkt, kann ambætarin góðtaka tokens, sum eru útgingin ella vóru ætlað til eitt annað forrit ZXCVFIXVIBETOKEN4ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG9. ## Betongviðgerðir ZXCVFIXVIBESEND ZXCVFIXVIBESEG10 1. Umsiting av dulnevnum undirskriftum: Set forritið upp til at vraka øll JWT, sum ikki brúka eina forgóðkenda, sterka undirskriftaralgoritmu (so sum RS256). ZXCVFIXVIBESEND ZXCVFIXVIBESEG11 2. Góðfest útgingin tíð: Set í verk eitt skyldugt eftirlit fyri at tryggja, at núverandi dagfesting og klokkutíð eru áðrenn tíðina, sum er tilskilað í JWT kravinum ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG12 3. Staðfest áhoyrarar: Tryggja tær, at JWT kravið inniheldur eitt virði, sum eyðmerkir lokalu tænastuna; um tænastan ikki er eyðmerkt í kravinum ZXCVFIXVIBETOKEN1ZXCV, skal tokenið vrakast ZXCVFIXVIBETOKEN2ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG13 4. Forða fyri endurtøku: Brúka pástandin JWT (ZXCVFIXVIBETOKEN2ZXCV ID) til at tilskila eitt einstakt eyðkenni til hvørt token, soleiðis at ambætarin kann fylgja við og vraka endurnýtt token ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG14 ## Uppdaganarstrategi ZXCVFIXVIBESEND ZXCVFIXVIBESEG15 Sárbarleikar í JWT handfaring kunnu eyðmerkjast við at greina token-bygnaðin og ambætarasvaratferðina: ZXCVFIXVIBESEND ZXCVFIXVIBESEG16 * Høvuðseftirlit: Kanna høvdið JWT (algoritma) fyri at tryggja, at tað ikki er sett til "eingin" og brúkar væntaðar kryptografiskar standardir ZXCVFIXVIBETOKEN1ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG17 * Kravváttan: Staðfesting av nærveru og gildi av JWT (útgingin) og ZXCVFIXVIBETOKEN1ZXCV (áhoyrarar) krav innan JSON nyttulastina ZXCVFIXVIBETOKEN2ZXCV. ZXCVFIXVIBESEND ZXCVFIXVIBESEG18 * Valideringsroynd: Roynd um ambætarin rætt vraka tokens, sum eru útgingin sambært JWT kravinum ella eru ætlað einum øðrum áhoyrarum sum definerað av ZXCVFIXVIBETOKEN1ZXCV kravinum ZXCVFIXCVVIBETOKEN2XZZ.

JSON Web Tokens (JWTs) provide a standard for transferring claims, but security relies on rigorous validation. Failure to verify signatures, expiration times, or intended audiences allows attackers to bypass authentication or replay tokens.

CWE-347CWE-287CWE-613

Attacker Impact

Improper JWT validation allows attackers to bypass authentication mechanisms by forging claims or reusing expired tokens [S1]. If a server accepts tokens without a valid signature, an attacker can modify the payload to escalate privileges or impersonate any user [S1]. Furthermore, failing to enforce the expiration (exp) claim allows an attacker to use a compromised token indefinitely [S1].

Root Cause

A JSON Web Token (JWT) is a JSON-based structure used to represent claims that are digitally signed or integrity protected [S1]. Security failures typically stem from two primary implementation gaps:

Acceptance of Unsecured JWTs: If a service does not strictly enforce signature verification, it may process "Unsecured JWTs" where the signature is absent and the algorithm is set to "none" [S1]. In this scenario, the server trusts the claims in the payload without verifying their integrity [S1].
Missing Claim Validation: The exp (expiration time) claim identifies the time on or after which the JWT must not be accepted for processing [S1]. The aud (audience) claim identifies the intended recipients of the token [S1]. If these are not checked, the server may accept tokens that are expired or were intended for a different application [S1].

Concrete Fixes

Enforce Cryptographic Signatures: Configure the application to reject any JWT that does not use a pre-approved, strong signing algorithm (such as RS256).
Validate Expiration: Implement a mandatory check to ensure the current date and time are before the time specified in the exp claim [S1].
Verify Audience: Ensure the aud claim contains a value identifying the local service; if the service is not identified in the aud claim, the token must be rejected [S1].
Prevent Replay: Use the jti (JWT ID) claim to assign a unique identifier to each token, allowing the server to track and reject reused tokens [S1].

Detection Strategy

Vulnerabilities in JWT handling can be identified by analyzing the token structure and server response behavior:

Header Inspection: Checking the alg (algorithm) header to ensure it is not set to "none" and uses expected cryptographic standards [S1].
Claim Verification: Confirming the presence and validity of the exp (expiration) and aud (audience) claims within the JSON payload [S1].
Validation Testing: Testing if the server correctly rejects tokens that have expired according to the exp claim or are intended for a different audience as defined by the aud claim [S1].