2

I'm currently exploiting the vulnerability discussed here

https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/

Where the algorithm type in JWT can be changed from RSA to HMAC and signing the token with a given public key.

However, I wrote the below python code:

import jwt
import base64

# consider 'publickey' as the servers public key
code = 
jwt.encode({'login':'test'},'publickey',algorithm='HS256')

This Throws an error :

InvalidKeyError: The specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.

Im looking for an alternative where I can successfully sign it using the asymmetric key.

Thanks

  • Have you tried editing the code? – Sjoerd Jun 7 '18 at 13:54
  • Editing in the sense?.. – Goron Jun 7 '18 at 13:58
  • The library was fixed to prevent this. That's what happens when vulnerabilities are reported... – AndrolGenhald Jun 7 '18 at 14:01
  • Actually I'm trying to exploit it on an predetermined environment. Where the server side code is vulnerable. So I wanted to exploit it. Is there any other options to do the same as the above code?.. – Goron Jun 7 '18 at 14:04
2

Use an old version of pyjwt (0.4.3) where this exception wasn't implemented yet.

pip install pyjwt==0.4.3
0

When running your program, it reports the line that throws the exception:

  File "/some-path/site-packages/jwt/algorithms.py", line 151, in prepare_key
    'The specified key is an asymmetric key or x509 certificate and'
jwt.exceptions.InvalidKeyError: The specified key is an asymmetric key or x509 certificate and should not be used as an HMAC secret.

So edit the file /some-path/site-packages/jwt/algorithms.py around line 151, so that it no longer throws the exception.

For example, put this in there:

invalid_strings = []
  • Ok.. I'll will try doing this.. – Goron Jun 7 '18 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.