Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
demo-cve-2022-21449 — Educational demo of CVE-2022-21449 Java ECDSA signature bypass using real and fake JWT tokens to illustrate the vulnerability and its impact on authentication. | Kitploit
Tools/GitHubGitHub/volodymyr-hladkyi-symphony/demo-cve-2022-21449
Vulnerability AnalysisWeb Application ExploitationCryptographyPenetration TestingAuthenticationLearning & Education
GitHubvolodymyr-hladkyi-symphony/demo-cve-2022-21449

demo-cve-2022-21449

Educational demo of CVE-2022-21449 Java ECDSA signature bypass using real and fake JWT tokens to illustrate the vulnerability and its impact on authentication.

View Repository
11 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Demo Project: CVE-2022-21449 Vulnerability

This project demonstrates the CVE-2022-21449 vulnerability, which affects Java's ECDSA signature verification. The vulnerability allows a malicious actor to bypass signature verification by using a signature with zero values (r=0 and s=0). The project uses real and fake JWT tokens with EC signatures to showcase the issue on Java 17 without the security patch.

Features

  • Real JWT Token: A valid JWT token signed with an EC private key.
  • Fake JWT Token: A JWT token with a zeroed signature (r=0, s=0).
  • Validation: Demonstrates how the vulnerability allows the fake token to pass validation.

Prerequisites

  • Java 17 (without the security patch for CVE-2022-21449).
  • Maven for building the project.

Project Structure

  • JwtGenerator: Generates real and fake JWT tokens.
  • JwtUtils: Validates JWT tokens using a public EC key.
  • SecurityConfig: Configures Spring Security to demonstrate token-based authentication.
  • ProtectedController: Provides endpoints to test token-based access control.

How to Use the JwtGenerator Console App

The JwtGenerator class is a standalone console application that generates and prints both valid and fake JWT tokens.

Steps to Run

  1. Build the Project:

    root@kitploit:~
    mvn clean install

  2. Run the JwtGenerator Class:

    root@kitploit:~
    mvn exec:java -Dexec.mainClass="com.symphony_solutions.demo.util.JwtGenerator"

  3. Output: The application will print:

    • A valid JWT token.
    • A fake JWT token with a zeroed signature.

    Example:

    root@kitploit:~
    === Valid JWT ===
eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhbGljZSIsInJvbGVzIjpbIkFETUlOIiwiVVNFUiJdLCJpYXQiOjE2NzAwMDAwMDAsImV4cCI6MTY3MDAzNjAwMH0.<signature>

=== Fake JWT with zero signature ===
eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJib2IiLCJyb2xlcyI6WyJBRE1JTiIsIlVTRVIiXSwiaWF0IjoxNjcwMDAwMDAwLCJleHAiOjE2NzAwMzYwMDB9.<zeroed_signature>

  4. Use the Tokens:

    • Copy the tokens and use them to test the vulnerability in the application or other tools.

Demonstrating the Vulnerability

  1. Start the Application:

    root@kitploit:~
    mvn spring-boot:run

  2. Access Protected Endpoints:

    • Use a valid token to access /protected/user or /protected/admin.
    • Use the fake token to demonstrate how the vulnerability allows unauthorized access.

  3. Endpoints:

    • /protected/user: Requires USER or ADMIN role.
    • /protected/admin: Requires ADMIN role.

Important Notes

  • This project is for educational purposes only. Do not use it in production environments.
  • Ensure your Java version is updated with the security patch to mitigate CVE-2022-21449.

References

  • CVE-2022-21449 Details
  • Java Security Updates

License

This project is licensed under the MIT License.

Download Tool