security auth_error ai_generated true

JWT RS256公钥被用作HMAC密钥导致令牌伪造

JWT RS256 public key used as HMAC secret allows token forgery

ID: security/jwt-rs256-public-key-as-hmac-secret

其他格式: JSON · Markdown 中文 · English
85%修复率
88%置信度
1证据数
2023-08-15首次发现

版本兼容性

版本状态引入弃用备注
jsonwebtoken 8.5.1 active — — —
PyJWT 2.4.0 active — — —
jjwt 0.9.1 active — — —

根因分析

JWT库在服务器未对'alg'头进行白名单验证时，将公钥用作HS256对称密钥，使攻击者可以伪造令牌。

English

The JWT library uses the public key as a symmetric secret for HS256 when the server trusts the 'alg' header without validating against a whitelist, enabling attackers to forge tokens.

generic

官方文档

https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

解决方案

  1. Explicitly whitelist allowed algorithms in JWT verification, e.g., in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] })
  2. Validate the 'alg' header against a server-side list before any cryptographic operation, rejecting tokens with unexpected algorithms like 'none' or 'HS256'
  3. Use asymmetric-only libraries that reject symmetric algorithms by default, e.g., jose in Python with require_kid=False

无效尝试

常见但无效的做法:

  1. 95% 失败

    Removes integrity checks entirely, making all tokens forgeable.

  2. 80% 失败

    Does not restrict the algorithm whitelist; attacker can still switch to HS256.

  3. 70% 失败

    Issuer verification does not prevent algorithm confusion; token header can be modified.