JWKS Leak

JSON Web Key Sets (JWKS) is a standard format for representing a set of cryptographic keys used for implementing digital signatures and encryption in web applications. jwks endpoint usually contains the public key that is used by resource servers to verify JWT. Misconfiguration of jwks endpoint can expose the private key. The private key can be abused by an adversary to forge tokens and get unauthorised access.

Remediation

Review jwks endpoint and make sure it does not accidentally exposes private keys, i.e. p, dp, dq and qi.

Metadata

Severity: high
Slug: jwks-leak

OWASP

A05:2021: Security Misconfiguration

Available Labs

Open Typescript labs in SecDim Play for this vulnerability.

hard

Jot.ts

TypeScript Hard Signature

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.