Listen to this Post
Authlib’s JWS verification fails to enforce RFC 7515 §4.1.11 for critical header parameters. The `crit` header lists parameters that a token recipient must understand and process. If a JWS header contains crit: ["bork"], the verifier must recognize “bork” or reject the token. Authlib 1.6.3 only verifies the cryptographic signature, ignoring the `crit` list’s “must-understand” requirement. This allows an attacker to craft a token with a fake critical parameter like “bork”. Strict verifiers (e.g., Nimbus, Node.jose) will correctly reject this token. However, in a system using Authlib, the same malformed token would be accepted, leading to a split-brain condition where a gateway rejects a token but an Authlib-based backend service accepts it. This discrepancy can bypass security policies, enabling privilege escalation or replay attacks if the critical parameter was meant to enforce a security control like token binding.
Platform: Authlib
Version: <=1.6.3
Vulnerability: JWS crit bypass
Severity: Critical
date: 2024-12-19
Prediction: 2024-12-26
What Undercode Say:
git clone https://github.com/example/authlib-crit-bypass-poc cd authlib-crit-bypass-poc python3 -m pip install authlib==1.6.3 node verify.js tokens/cnf_header.jwt java -jar target/nimbus-verifier.jar tokens/unknown_crit.jwt python3 authlib_verify.py tokens/cnf_header.jwt
from authlib.jose import JsonWebSignature
jws = JsonWebSignature()
This incorrectly accepts the token with an unknown critical header.
data = jws.deserialize_compact('eyJhbGciOiJIUzI1NiIsImNyaXQiOlsiYm9yayJdLCJib3JrIjoieCJ9.SGVsbG8gV29ybGQ.4q5dW8j5R6n8w9v0x1y2z3a4b5c6d7e8f9g0h1i')
payload = data['payload']
How Exploit:
Craft a JWT with a `crit` header containing an unknown parameter. Use this token to bypass strict verifiers and target backend services using vulnerable Authlib versions.
Protection from this CVE:
Upgrade Authlib to version 1.6.4 or later. Implement a consistent JWT verification library stack across all services.
Impact:
Policy Bypass, Privilege Escalation, Replay Attacks, Split-brain Verification.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
