JWT signature verification disabled or bypassed
ID |
vbnet.cryptography.jwt_signature_verification_bypass |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Cryptography |
Language |
VB.NET |
Description
JWT signature verification is disabled: ValidateIssuerSigningKey = False, RequireSignedTokens = False, or a custom SignatureValidator that returns the parsed token without verifying its signature. This lets an attacker forge tokens with arbitrary claims. Leave ValidateIssuerSigningKey and RequireSignedTokens at their secure default (True) and do not install a SignatureValidator that skips verification.
Rationale
JWT signature verification is disabled: ValidateIssuerSigningKey = False, RequireSignedTokens = False, or a custom SignatureValidator that returns the parsed token without verifying its signature. This lets an attacker forge tokens with arbitrary claims. Leave ValidateIssuerSigningKey and RequireSignedTokens at their secure default (True) and do not install a SignatureValidator that skips verification.
The following code illustrates a vulnerable pattern detected by this rule:
Public Function BuildParamsAssign() As TokenValidationParameters
Dim opts = New TokenValidationParameters()
' VULNERABLE: JWT signature verification disabled or bypassed
opts.ValidateIssuerSigningKey = False
' VULNERABLE: JWT signature verification disabled or bypassed
opts.RequireSignedTokens = False
Return opts
End Function