feat: implement header param injection handling for JWT vulnerabilities #473
Conversation
| public ResponseEntity<GenericVulnerabilityResponseBean<String>> getHeaderInjectionVulnerability( | ||
| HttpServletRequest request) { | ||
| String headerValue = request.getHeader("User-Defined-Header"); | ||
| if (headerValue != null && headerValue.contains("malicious")) { |
There was a problem hiding this comment.
@leiberbertel I think this is not the right way to implement the header param injection. The real vulnerability is with optional headers like JWK or KID or JKU as implemention of library will start relying on the data provided as part of these headers for verifying signature.
Having custom/user defined headers is not wrong or considered malicious.
A simple attack is say JWT library is relying on the public key provided as part of JWK header instead of validating the public key provided with the whitelisted public key set. so attack would be a malicious user will generate key pairs and sign the jwt with its own private key and passed public key as JWK header. The backend will not validate public key against a whitelist and start relying on provided public key to validate the JWT.
There was a problem hiding this comment.
Hi @preetkaran20,
I really appreciate your detailed review and the points you highlighted. I completely agree that attacks via headers such as JWK, KID or JKU pose a significant threat, especially when the implementation does not properly validate public keys against a trusted set.
My intent with the current implementation was to demonstrate how user-defined headers can be manipulated, but I see that focusing on these critical headers such as JWK could provide a more realistic and educational example of common vulnerabilities in JWTs.
I will revise the implementation to incorporate these examples, ensuring that we clearly demonstrate how the lack of proper validation of public keys can be exploited.
Regards.
| @@ -245,6 +245,11 @@ function doGetAjaxCall(callBack, url, isJson) { | |||
| "Content-Type", | |||
| isJson ? "application/json" : "text/html" | |||
| ); | |||
|
|
|||
| for (const header in headers) { | |||
Added handling for header parameter injection in
JWTVulnerability.java, addressing the missing attack vector noted in issue #413. Follows https://portswigger.net/web-security/jwt guidelines.Ref: #413