3 ms·
They list the php-jwt library from firebase as vulnerable but I can't see why. As far as I can see they do not support the None algorithm. https://github.com/f
by mfjordvald 12y ago
They list the php-jwt library from firebase as vulnerable but I can't see why. As far as I can see they do not support the None algorithm.
https://github.com/firebase/php-jwt/blob/master/Authentication/JWT.php https://github.com/firebase/php-jwt/blob/master/Authenticati...
It's not in the methods array and the decode method specifically does a check to see if it's empty.
if (empty($header->alg)) { throw exception }
Can anyone throw some light on this?
- ploxiln 12y agoThe second critical problem, which is not addressed by php-jwt, is that it does not take as a parameter to the decode() function which algorithm should be used. It figures out the algorithm by looking at the header. As the original post describes, if your code expected to use a RSA public/private key pair, then it will pass the public key to decode(). Then an attacker can craft a JWT that claims to use a HMAC symmetric key and sign it with the public key, which is public. One and done. (your code in that case expected the header to specify an RSA algorithm, and be signed with the private key. but the decode() function doesn't know that)
- mfjordvald 12y agoCheers, so using this library only to encode should not be an issue for us.
- zaroth 12y agoAs in, a third party is doing the decode? You should check which library they are using...