Exploit JWT Signature Flaw

What is JWT Token?

A JWT (JSON Web Token) is a compact, URL-safe string used to securely transmit information between two parties. It’s commonly used for authentication (proving who you are) and authorization (determining what you’re allowed to access).

JWT-based authentication is designed to be stateless, meaning the server typically does not maintain any record of the tokens it issues. Instead, each JWT is self-contained, carrying all the information required to identify the user and validate the request.

Since the server does not store the original token or its signature, it must verify the JWT’s signature on every request to ensure the token is authentic and has not been altered.

If the server fails to properly validate the signature—or incorrectly implements the verification process—an attacker may be able to forge or modify tokens, potentially gaining unauthorized access, escalating privileges, or compromising sensitive resources.

Attack Scenario

During testing, we identified that the application does not properly validate the JWT signature. To verify this issue, we intercepted a Delete Account request using Burp Suite and sent it to Repeater for further analysis.

Using the JSON Web Token extension in Burp Suite, we modified the JWT by selecting the "None" algorithm attack. This changed the token’s header to use the alg: none algorithm and removed the signature portion of the JWT.

After sending the modified request, the server responded with HTTP 200 OK, indicating that the request was successfully processed even though the JWT signature had been removed. This confirms that the application does not properly validate the JWT signature before authorizing sensitive operations.

Notice that, Delete Account request was successfully executed, and the account was deleted despite the token being unsigned.

Mitigation

1. Always validate the JWT signature using a trusted algorithm and signing key.
2. Reject unsigned (alg: none) or tampered tokens.
3. Enforce proper claim validation before authorizing any request.