security auth_error ai_generated true

JWT algorithm confusion: RS256 token accepted when HS256 expected

ID: security/oauth2-jwt-algorithm-confusion-rs256-hs256

Also available as: JSON · Markdown · 中文
85%Fix Rate
88%Confidence
1Evidence
2024-03-15First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
jsonwebtoken 8.5.1 active — — —
jjwt 0.11.5 active — — —
PyJWT 2.8.0 active — — —

Root Cause

The JWT library is configured to accept both RS256 (asymmetric) and HS256 (symmetric) algorithms, allowing an attacker to sign a token with the public key as the HMAC secret, bypassing signature verification.

generic

中文

JWT库配置为同时接受RS256（非对称）和HS256（对称）算法，攻击者可以使用公钥作为HMAC密钥对令牌签名，绕过签名验证。

Official Documentation

https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

Workarounds

  1. 90% success In the JWT verification function, explicitly specify the allowed algorithms and reject any token that uses a different one. For example, in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] }) 
    In the JWT verification function, explicitly specify the allowed algorithms and reject any token that uses a different one. For example, in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] })
  2. 85% success Use a library that enforces a single algorithm by default, such as jose (v4+) which requires explicit algorithm selection. 
    Use a library that enforces a single algorithm by default, such as jose (v4+) which requires explicit algorithm selection.
  3. 80% success Add a check that the 'alg' header is exactly the expected value before calling the verify function, and reject otherwise. 
    Add a check that the 'alg' header is exactly the expected value before calling the verify function, and reject otherwise.

中文步骤

  1. 在JWT验证函数中，明确指定允许的算法，并拒绝使用不同算法的任何令牌。例如，在Node.js中：jwt.verify(token, publicKey, { algorithms: ['RS256'] })
  2. 使用默认强制单一算法的库，例如jose（v4+），它需要显式选择算法。
  3. 在调用验证函数之前，添加检查'alg'头是否完全等于预期值的逻辑，否则拒绝。

Dead Ends

Common approaches that don't work:

  1. 40% fail

    Simply disabling HS256 globally breaks legitimate symmetric token use cases in other parts of the system.

  2. 60% fail

    Adding a blacklist of known bad keys doesn't address the root cause — the library must enforce a single algorithm per token, not rely on external lists.

  3. 30% fail

    Upgrading the JWT library without changing the verification code may not help if the code explicitly passes both algorithms to the verifier.