Summary #

Netsparker detected that the application is vulnerable to the Json Web Tokens (JWT) “jku” header signature bypass through an open redirect.

Impact #

By changing the value of the jku parameter in the header, an attacker can force the application to utilize a malicious JWT and bypass the signature. If URL filtering is in place within the application an attacker might chain this attack with an open redirect to bypass URL filtering and forge their own signature.

Remediation #

The application has to have the list of allowed hosts and have correct URL filtering in place. Also, the application must not contain other vulnerabilities that an attacker can chain to bypass URL filtering such as:

  • Open redirect
  • Header Injection
  • SSRF
Classifications #
CWE-347; OWASP 2017-A2
Vulnerability Index

Vulnerability Index

You can search and find all vulnerabilities

OR

Search Vulnerability

Netsparker

Dead accurate, fast & easy-to-use Web Application Security Scanner

Get a demo