Open new temporary project in Burp (2021.12 Early Adopter - installer version)
Load 'JSON Web Tokens' extension
Select 'JSON Web Tokens' tab
Paste valid JWT Token with RS256 algorithm into 'Enter JWT' text area:
eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ1c2VybmFtZSI6InRlc3QiLCJhZG1pbiI6ZmFsc2V9.i8bDiqGHk5xcNyzSgQgF4u_VoCrWecMmgXR7TLIpcQFgF8SLWm-_QKUp1tshc0qkufftvTeu88TD9EcG23K1uoq2qWGHQqKNGhVbFUFQrkRDbYL4LU9wiPP5IwzqcjvvYPclJbPDJLrfpdpXAAkJdBfIykVvVs93tT7gyk0Vd82iUGJEorN0fZmRZD4YUuf1BGYLKovF2YzWGP7ucFiXEqJWtxoLfLxH5uMjODV6n9S0P-6eGb43xZl2v-w9nDW6Kb4bbTUP8qzmFjehUno8BCwwHtEe1Kx1Xb7plzx4TwPOwCmn1vP2gekuTcgjUvDeIOLnzMt7uDR-8oA80HJl6g
Token not decoded and NullPointerException triggered:
java.lang.NullPointerException: Cannot invoke "String.length()" because "key" is null at app.algorithm.AlgorithmLinker.generatePublicKeyFromString(AlgorithmLinker.java:56) at app.algorithm.AlgorithmLinker.getKeyInstance(AlgorithmLinker.java:176) at app.algorithm.AlgorithmLinker$2.getPublicKeyById(AlgorithmLinker.java:147) at app.algorithm.AlgorithmLinker$2.getPublicKeyById(AlgorithmLinker.java:143) at com.auth0.jwt.algorithms.RSAAlgorithm.verify(RSAAlgorithm.java:45) at com.auth0.jwt.JWTVerifier.verify(JWTVerifier.java:287) at com.auth0.jwt.JWTVerifier.verify(JWTVerifier.java:271) at app.controllers.JWTSuiteTabController.contextActionKey(JWTSuiteTabController.java:89) at app.controllers.JWTSuiteTabController.contextActionSendJWTtoSuiteTab(JWTSuiteTabController.java:77) at app.controllers.JWTSuiteTabController$1.insertUpdate(JWTSuiteTabController.java:139)
Variation of bug also exists with ES256 algorithm, e.g. using:
DolphFlynn
commented
2 years ago
eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ1c2VybmFtZSI6InRlc3QiLCJhZG1pbiI6ZmFsc2V9.i8bDiqGHk5xcNyzSgQgF4u_VoCrWecMmgXR7TLIpcQFgF8SLWm-_QKUp1tshc0qkufftvTeu88TD9EcG23K1uoq2qWGHQqKNGhVbFUFQrkRDbYL4LU9wiPP5IwzqcjvvYPclJbPDJLrfpdpXAAkJdBfIykVvVs93tT7gyk0Vd82iUGJEorN0fZmRZD4YUuf1BGYLKovF2YzWGP7ucFiXEqJWtxoLfLxH5uMjODV6n9S0P-6eGb43xZl2v-w9nDW6Kb4bbTUP8qzmFjehUno8BCwwHtEe1Kx1Xb7plzx4TwPOwCmn1vP2gekuTcgjUvDeIOLnzMt7uDR-8oA80HJl6gjava.lang.NullPointerException: Cannot invoke "String.length()" because "key" is null at app.algorithm.AlgorithmLinker.generatePublicKeyFromString(AlgorithmLinker.java:56) at app.algorithm.AlgorithmLinker.getKeyInstance(AlgorithmLinker.java:176) at app.algorithm.AlgorithmLinker$2.getPublicKeyById(AlgorithmLinker.java:147) at app.algorithm.AlgorithmLinker$2.getPublicKeyById(AlgorithmLinker.java:143) at com.auth0.jwt.algorithms.RSAAlgorithm.verify(RSAAlgorithm.java:45) at com.auth0.jwt.JWTVerifier.verify(JWTVerifier.java:287) at com.auth0.jwt.JWTVerifier.verify(JWTVerifier.java:271) at app.controllers.JWTSuiteTabController.contextActionKey(JWTSuiteTabController.java:89) at app.controllers.JWTSuiteTabController.contextActionSendJWTtoSuiteTab(JWTSuiteTabController.java:77) at app.controllers.JWTSuiteTabController$1.insertUpdate(JWTSuiteTabController.java:139)eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJFUzI1NmluT1RBIiwibmFtZSI6IkpvaG4gRG9lIn0.MEQCICRphRrc0GWowZgJAy0gL6At628Kw8YPE22iD-aKIi4PAiA0JWU-qFNL8I0tP0ws3Bbmg0FfVMn4_yk2lGGquAGOXA