JWKS Leak

JSON Web Key Sets (JWKS) is a standard format for representing a set of cryptographic keys used for implementing digital signatures and encryption in web applications. `jwks` endpoint usually contains the public key that is used by resource servers to verify JWT. Misconfiguration of jwks endpoint can expose the private key. The private key can be abused by an adversary to forge tokens and get unauthorised access.

Remediation

Review jwks endpoint and make sure it does not accidentally exposes private keys, i.e. `p`, `dp`, `dq` and `qi`.

Metadata

Severity: high
Slug: jwks-leak

OWASP

A05:2021: Security Misconfiguration

Available Labs

Select a language to explore available labs for this vulnerability.

1 Lab

Javascript Labs

Javascript 1 lab

Explore 1 lab in Javascript.

1 Lab

Typescript Labs

Typescript 1 lab

Explore 1 lab in Typescript.

No matching labs found

Try adjusting your language filter.

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.