JWK Injection in Cisco node-jose

Repository is a Python JWT security testing toolkit (“claimjumper”) rather than a single exploit for one product. It provides: (1) JWT decoding and vulnerability analysis with risk scoring (claimjumper/decoder.py, analyzer.py), (2) token forging (alg=none and HS256 with a provided secret) (forger.py), (3) multi-threaded HMAC secret brute forcing for HS256/384/512 using built-in/common secrets and optional wordlists (cracker.py plus wordlists/jwt_secrets.txt; also references a Wallarm wordlist path), (4) an “advanced_attacks” module that generates multiple CVE/pattern-based attack tokens (notably CVE-2022-39227 algorithm confusion, CVE-2018-0114 key injection, CVE-2022-21449 psychic signature, CVE-2020-28042 null signature bypass, plus kid/jku/x5u/jwks spoofing and timestamp tampering), (5) a fuzzing engine with payload libraries for path traversal, SQLi, NoSQLi, command injection, SSRF, etc. (fuzzer.py), and (6) optional live HTTP replay/testing and a playbook-style scanner using `requests` (http_tester.py) that can inject tokens into requests and look for canary/response changes; it logs to jwt_attack.log. The primary entry point is the Click-based CLI (claimjumper/cli.py) exposing commands like analyze, crack, forge/forge-none, advanced-attacks, fuzz, keygen, and full-audit. A standalone local HTML UI (jwt_analyzer.html) provides basic client-side decoding/forging guidance but does not itself perform signing. Overall purpose: generate and test malicious JWT variants against vulnerable JWT verification implementations and assist in auditing JWT configurations.

This repository is a proof-of-concept exploit for CVE-2018-0114, a vulnerability in Cisco ASA and FTD software related to improper verification of JWT signatures. The exploit is implemented in Go and consists of several files: - `main.go`: The entry point, parses the claim argument, generates an RSA key pair, constructs a JWT header with the public key, signs the token, and outputs the JWT. - `keys.go`: Handles RSA key generation and signing. - `jwt.go`: Handles JWT header construction and base64 encoding. - `banner.go`: Displays an ASCII art banner for the exploit. - `go.mod` and `go.sum`: Go module dependencies. - `README.md`: Usage instructions and background. The exploit allows a user to generate a JWT with arbitrary claims (such as 'admin'), signed with a generated RSA key, and embeds the public key in the JWT header. This leverages the vulnerability where the target system may incorrectly trust the public key provided in the JWT header, allowing authentication bypass or privilege escalation. No hardcoded endpoints or IPs are present; the exploit is generic and intended to be used against any vulnerable Cisco system. The code is a standalone proof-of-concept and does not include weaponized features or automation for targeting live systems.

This repository is a proof-of-concept (PoC) exploit for CVE-2018-0114, a vulnerability in Cisco ASA's JWT signature validation. The main file, 'script.py', generates an RSA key pair, constructs a JWT with a custom JWK header (including the attacker's public key), and signs a payload (e.g., 'admin'). The resulting JWT can be used to impersonate users if the target server is vulnerable. The exploit demonstrates the attack by printing the crafted JWT. The repository contains standard support files (README, LICENSE, requirements.txt, .gitignore) and is written in Python. No hardcoded network endpoints are present, but the attack is intended for networked Cisco ASA devices that accept JWTs. The exploit is a PoC and does not include weaponized or automated attack features.

This repository is a Go-based operational exploit tool targeting JWT (JSON Web Token) vulnerabilities, including CVE-2015-9235, CVE-2016-10555, CVE-2018-0114, and CVE-2020-28042. The tool provides both command-line and interactive modes for penetration testers to generate and test JWTs against web applications. It supports multiple attack modes: modifying JWT headers (e.g., setting 'alg' to 'none'), exploiting missing signature validation, switching from RS256 to HS256, JWKS key injection, and brute-forcing JWT secrets using dictionaries or character sets. The tool can generate fuzzing dictionaries and outputs results to files for further testing. The codebase is organized into modules for command handling, JWT manipulation, brute-forcing, and utility functions. No hardcoded network endpoints are present, but several file paths are used for input/output. The exploit is mature and operational, providing practical attack payloads and automation for JWT vulnerability exploitation.

This repository contains a Ruby proof-of-concept exploit for CVE-2018-0114, a vulnerability in the Cisco node-jose library (versions prior to 0.11.0). The exploit demonstrates how an attacker can forge JWT tokens by embedding a public key in the token header and signing the token with the corresponding private key. The main exploit file, 'CVE-2018-0114.rb', reads a private RSA key from 'private.pem', constructs a JWT header with the public key, encodes a victim username as the payload, and generates a valid signature. The resulting JWT token can be used to impersonate arbitrary users on systems that use vulnerable versions of node-jose for JWT verification. The repository also includes a README.md explaining the vulnerability and usage instructions. The exploit does not target a specific endpoint but is intended to generate tokens for use against any vulnerable service using node-jose for JWT validation.

This repository provides a proof-of-concept (POC) exploit for CVE-2018-0114, a vulnerability in Cisco's node-jose library (versions prior to 0.11.0) for Node.js. The vulnerability allows an attacker to forge JSON Web Tokens (JWTs) by embedding a public key (JWK) in the token header and signing the token with the corresponding private key. The exploit is implemented in a single Python script, 'jwk-node-jose.py', which generates an RSA key pair, constructs a JWT header with the attacker's public key, encodes a user-supplied payload, signs the token, and outputs a forged JWT. The README provides background, usage instructions, and references. The attack vector is network-based, targeting applications that use vulnerable versions of node-jose for JWT verification. No hardcoded network endpoints are present, but the exploit is designed to generate tokens for use against remote services. The repository is structured simply, with the main exploit logic contained in one Python file, and includes standard documentation and licensing files.