Injection: JWT Algorithm Confusion (RS256 to HS256)¶

Identifier: jwt_alg_confusion_rs_to_hs

Scanner(s) Support¶

Description¶

JWT algorithm confusion (RS256 to HS256) occurs when a server that expects asymmetrically signed tokens (RS256) trusts the algorithm declared in the JWT header and verifies an HS256 signature using the RSA public key as the HMAC secret. An attacker can forge tokens by switching the algorithm to HS256 and signing with the publicly available key, bypassing authentication.

How we test: We observe JWTs signed with RS256, change the header algorithm to HS256, re-sign the token using the server's RSA public key as the HMAC secret, and replay the authenticated request. If the server accepts the forged token, it is vulnerable to RS256-to-HS256 algorithm confusion.

Prerequisites:

• The scan must observe an authenticated request that uses a JWT signed with an asymmetric algorithm (e.g. RS256).

References:

• CWE-287: Improper Authentication
• OWASP API Security Top 10 API2:2023 Broken Authentication
• PortSwigger Web Security Academy: Algorithm confusion attacks
• NIST SP 800-63B: Digital Identity Guidelines

Configuration¶

Example¶

Example configuration:

---
security_tests:
  jwt_alg_confusion_rs_to_hs:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.