Psychic Signature Improper ECDSA Verification in Oracle Java

Repository is a Python JWT security testing toolkit (“claimjumper”) rather than a single exploit for one product. It provides: (1) JWT decoding and vulnerability analysis with risk scoring (claimjumper/decoder.py, analyzer.py), (2) token forging (alg=none and HS256 with a provided secret) (forger.py), (3) multi-threaded HMAC secret brute forcing for HS256/384/512 using built-in/common secrets and optional wordlists (cracker.py plus wordlists/jwt_secrets.txt; also references a Wallarm wordlist path), (4) an “advanced_attacks” module that generates multiple CVE/pattern-based attack tokens (notably CVE-2022-39227 algorithm confusion, CVE-2018-0114 key injection, CVE-2022-21449 psychic signature, CVE-2020-28042 null signature bypass, plus kid/jku/x5u/jwks spoofing and timestamp tampering), (5) a fuzzing engine with payload libraries for path traversal, SQLi, NoSQLi, command injection, SSRF, etc. (fuzzer.py), and (6) optional live HTTP replay/testing and a playbook-style scanner using `requests` (http_tester.py) that can inject tokens into requests and look for canary/response changes; it logs to jwt_attack.log. The primary entry point is the Click-based CLI (claimjumper/cli.py) exposing commands like analyze, crack, forge/forge-none, advanced-attacks, fuzz, keygen, and full-audit. A standalone local HTML UI (jwt_analyzer.html) provides basic client-side decoding/forging guidance but does not itself perform signing. Overall purpose: generate and test malicious JWT variants against vulnerable JWT verification implementations and assist in auditing JWT configurations.

This repository is a proof-of-concept (PoC) exploit for CVE-2022-21449, a vulnerability in Java's ECDSA signature verification. The project is structured as a Spring Boot application with JWT-based authentication. It includes code to generate both valid and fake JWT tokens (the latter with a zeroed ECDSA signature), and demonstrates how, on vulnerable Java versions, the fake token is accepted as valid, allowing unauthorized access to protected endpoints. The main entry points are the DemoApplication (Spring Boot app) and JwtGenerator (console app for generating tokens). The application exposes two protected HTTP endpoints: '/protected/user' and '/protected/admin', which require specific roles. The exploit demonstrates that, due to the vulnerability, an attacker can craft a JWT with a zeroed signature and gain access to these endpoints without proper authorization. The repository includes all necessary keys and configuration files for demonstration purposes. This PoC is intended for educational use and highlights the importance of patching Java to mitigate this vulnerability.

This repository is a Proof-of-Concept (PoC) for CVE-2022-21449 (Psychic Signatures), which affects ECDSA signature verification in Java (and potentially other implementations). The PoC demonstrates how a malicious TLS server can present an invalid ECDSA signature (r = s = 0) that is accepted by a vulnerable client, allowing the TLS handshake to succeed without proper cryptographic validation. The repository includes a modified Go crypto library (crypto/ecdsa and crypto/tls) to simulate the vulnerability, a malicious TLS server implementation (go-server-test/main.go), and scripts to build the environment (build.sh). The server uses a certificate chain for www.google.com and disables key matching checks, making it possible to demonstrate the attack. The main attack vector is network-based, targeting clients that connect to the malicious server. The PoC does not weaponize the exploit but provides a clear demonstration of the vulnerability's impact.