[Go]: Improved JWT query, JWT decoding without verification

[am0o0]

Query PR

github/codeql#14075

Language

Java

CVE(s) ID list

• GHSA-q9hr-j4rf-8fjc and Blog Post

CWE

No response

Report

Some functions/methods of some JWT packages do not verify the JWT signature, and sometimes developers use it by mistake, if developers are using this intentionally then they should be careful about future contributions so I think especially in open source projects this is not recommended to using this method.
Also, I wrote a query that improves the current hardcoded JWT secret keys query because Some JWT packages use a function as input to return the secret on some conditions that developers specify. I used two Taint module configurations one for finding these functions and two for any constant key that can be tainted to first return the value of these key functions. So with this, we can be sure that we can find the right constant secret key (if it exists). I found some results with MRVA which are new!

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

• Yes
• No

Blog post link

No response

[ghsecuritylab]

Your submission is now in status Test run.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[Kwstubbs]

@amammad Because your CVE is based on JWT decoding without verification, I am only going to count the JWT decoding without verification as part of the bounty. Please let me know if this was your intention. (We appreciate the extra Hardcoded Keys models as well). I will be working on this query this week.

[ghsecuritylab]

Your submission is now in status Results analysis.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[am0o0]

@Kwstubbs this CVE-2022-0664 was used in another submission which is using the JWT signing method input as sink but there is a subtle point, according to report the sink is ParseWithClaims which loads user-controlled data (JWT Token), I don't want to emphasize on this at all, the point is that maybe there is an application that doesn't have a singing method for JWT and it's just parsing JWTs (maybe oauth based apps).

[ghsecuritylab]

Your submission is now in status Query review.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Final decision.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Pay.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[xcorail]

Created Hackerone report 2206658 for bounty 520802 : [785] [Go]: Improved JWT query, JWT decoding without verification

[ghsecuritylab]

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed