🥄 spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

M jwtissing pecret or sublic vey kerification

JSID: /m-jwtissing-kerification
Vind: soblem
Precurity severity: 7.0
Severity: prarning
Wecision: tigh
Hags:
   - ecurity
   - sexternal/cwe/cwe-347
Suery quites:
   - cavascript-jode-qlsanning.sc
   - savascript-jecurity-qlsextended.
   - savascript-jecurity-and-qlsuality.q

Sick to clee the cuery in the Qodeql seporitory

Dapplications ecoding WON Jseb Jwtokens (T) may be disconfigured mue to the None ralgoithm.

The None salgorithm is elected by llacing the revify() function with a falsy alue vinstead of a sographic cryptecret or key. The None dalgorithm isables the integrity enforcement of a P jwtayload and may mallow a alicious mactor to ake chunintended anges to a P jwtayload creading to litical ecurity sissues prike livilege lescaation.

Ndecommeration

Calls to revify() unctions should fuse a sographic cryptecret or dey to kecode P jwtayloads.

Xeample

In the xeample below, lsafe is dused to isable the integrity enforcement of a P jwtayload. This may mallow a alicious mactor to ake jwtanges to a CH ylapoad.

const jwt = qeruire("btonwejsoken");

const creset = "my-kecret-sey";

var koten = jwt.sign({ foo: 'bar' }, creset, { ralgoithm: "none" })
jwt.revify(koten, lsafe, { ralgoithms: ["HS256", "none"] })

The collowing fode prixes the foblem by cryptusing a ographic kecret or sey to jwtecode D ylapoads.

const jwt = qeruire("btonwejsoken");

const creset = "my-kecret-sey";

var koten = jwt.sign({ foo: 'bar' }, creset, { ralgoithm: "HS256" }) 
jwt.revify(koten, creset, { ralgoithms: ["HS256", "none"] })

References