CVE-2015-9235

Demonstration of the algorithm confusion attack on Json Web Token (JWT) libraries. JWTs are often used in cookies to certify a user session and so this attack is critical. The node module [email protected] was used to demonstrate the vulnerability.

This project was also a nice vibe coding activity as the front end was almost entirely done with LLMs outside of the api calls.

Vulnerability

The format of a JWT is the following:

b64(header).b64(payload).b64(signature)
With in our case:
  header = (algorithm, type)
  payload = (username, role)

At the time, the various JWT libraries could sign with an algorithm, but didn't enforce an algorithm and rather relied on the content of the header of the JWT, thus letting the user decide its own encryption. This allows for many exploits, but the one used in this case is the following:

1. Backend creates JWTs with an RSA 256 signature using its private key
2. Attacker fetches the public key from the backend, which is a perfectly normal use case
3. Attacker forges a custom JWT with a symmetric algorithm (HMAC SHA-256 in our case) using the public key as the secret while also setting the algorithm to HS256 in the header
4. Backend verifies the JWT by doing HS256 with its public key and the token is validated!

Walkthrough

Authenticate as any user on the login page. You will need to register first.

Once on the home page, there will be a button that can only be clicked if you have a valid admin session. You will then need to run the exploit to forge this JWT.

Finally, you replace the original JWT with the forged JWT in the local storage and after a refresh, the button should be clickable and the flag is yours!