JWT Signature Verification Bypass

python.jwt_signature_verification_bypass

Severity

high

Resource

Cryptography

Language

Python

Description

Improper verification of JWT cryptographic signature.

Rationale

JWT signature verification bypass refers to a scenario where a JSON Web Token, designed to be a secure way to transmit information between parties, is not properly checked for a valid signature.

This can allow attackers to forge tokens, gaining unauthorized access to protected resources or services.

In Python, JWT handling is often done using libraries like pyJWT. For example, consider the following sample code using the pyJWT library:

import jwt

jwt.decode(encoded, options={"verify_signature": False}) # FLAW

In the example above, the signature is not verified since the verify_signature=false argument is provided.

Remediation

To remediate the JWT signature verification bypass, ensure that you are properly configuring the JWT parser in use, and always verifying the token signature with a trusted public key or secret.

Furthermore, make sure your JWT libraries are updated to the latest versions, which often address security vulnerabilities and provide enhanced capabilities. Additionally, it’s important to apply similar best practices across all environments where JWTs are used or processed to maintain consistent security assurances.

Here’s how you can correctly verify a JWT signature using the pyJWT library:

import jwt

jwt.decode(encoded)

In the example above, the signature is verified when using the default decode behaviour.

References

CWE-347 : Improper Verification of Cryptographic Signature