Lab 7 JWT authentication bypass via algorithm confusion
Last updated
This lab uses a JWT-based mechanism for handling sessions. It uses a robust RSA key pair to sign and verify tokens. However, due to implementation flaws, this mechanism is vulnerable to algorithm confusion attacks.
To solve the lab, first obtain the server's public key. This is exposed via a standard endpoint. Use this key to sign a modified session token that gives you access to the admin panel at /admin, then delete the user carlos.
You can log in to your own account using the following credentials: wiener:peter
Visit Algorithm Confusion Attack, STEPS section for detailed steps of this attack.
Vuln: Server accepts both RS256 and HS256, using the same key variable for both - allowing its own public key to be reused as an HMAC secret.
Steps:
Log in as wiener, confirm /admin requires sub: administrator.
Fetch the server's public key from /jwks.json. Copy the single JWK object from the keys array.
In JWT Editor Keys → New RSA Key → paste the JWK → save.
Right-click the key → Copy Public Key as PEM.
In Decoder, Base64-encode the PEM string.
New Symmetric Key → Generate → replace k with the Base64-encoded PEM → save.
On the JWT: change alg → HS256, change sub → administrator.
Sign using the symmetric key created in step 6 (header unchanged otherwise).
Send to /admin → access granted, since the server's public key (as PEM bytes) matches the HMAC secret used to forge the signature.
Delete carlos via /admin/delete?username=carlos.
Root cause: Same key object reachable via two algorithm paths (RS256 verify vs HS256/HMAC), with the attacker-controlled alg header deciding which path runs.
Fix: Pin one algorithm per key/endpoint server-side (algorithms=["RS256"] only); never let the token's alg claim select the verification method.
Last updated