Three New Attacks Against JSON Web Tokens
summary
Three concrete attacks against JWT implementations: sign-encrypt confusion lets an attacker swap a signed JWT for an encrypted one and force a validator to decrypt with an RSA private key (older libs like pyjwt/cryptography were affected until patched); polyglot JWT crafts a JSON-format token that one library validates while another parses into arbitrary admin claims; billion-hashes DoS sets KDF iterations to 2^31-1, causing billions of hash rounds to crash servers. Exploits use common tools (JWT Editor Burp plugin); six libraries proved vulnerable and were patched.
AI-written summary · about
chapters (7)
- 0:00JWT research introduction
- 1:08JSON Web Tokens background
- 15:42JWT specification flaws
- 20:59Sign-Encrypt Confusion attack
- 29:13Polyglot JWT attack
- 32:48Billion Hashes attack
- 37:44JWT security summary
related talks
35mAttacks on JSON Web Tokens: A Comprehensive Analysis
48mThe Hacker's Guide to JWT Security
43mDo You Really Know JWT?
47mThe Hacker's Guide to JWT Security
31mThe Hacker's Guide to JWT Security
25mHandling JWTs: Understanding Common Pitfalls
37mThe Hacker's Guide to JWT Security
15mJWTs And Why They Suck