Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Scanning modes don't work with JWT already containing a "jku" header #90

Open
h49nakxs opened this issue Jan 15, 2023 · 0 comments
Open

Comments

@h49nakxs
Copy link

Hello,

Thanks for your great tool, really handy to test JWT 👍

Just want to report a small issue. The scanning modes "-M pb" and "-M at" don't work with a JWT in which there's already a "jku" header.

The problem lies starting 1432 :

    try:
        origjku = headDict["jku"]
    except:
        origjku = False
        if config['services']['jwksloc']:
            jku = config['services']['jwksloc']
        else:
            jku = config['services']['jwksdynamic']
    newContents, newSig = exportJWKS(jku)
    jwtOut(newContents+"."+newSig, "Exploit: Spoof JWKS (-X s)", "Signed with JWKS at "+jku)

The variable "jku" is never set if there's already a "jku" header inside the token, thus the program throws an error.

disasmwinnie added a commit to WALLSEC/jwt_tool that referenced this issue Apr 1, 2024
I belive this addresses the problem described in issue ticarpi#90.
To reproduce the undefined var in line it I had to run in the scan mode
"-M at" and you need a JWT that defines "jku" field. In that case the try
block before succeds. That lead to the "jku" variable never to be defined.
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant