Avoid Logging JWT Contents to Prevent Sensitive Data Exposure

[cjackett]

Description: The current implementation in pages/api/validate-admin-jwt.ts logs the JWT contents when a JWT fails validation. This poses a risk of sensitive data exposure, as JWTs often contain information such as user emails or other identifying details.

Affected Code:

try {
    payload = jwt.verify(cookie, JWT_SECRET) as JWT_Payload
} catch (e) {
    pushover(
        'Invalid JWT signature',
        `${req.headers.origin} ${req.url}\n${JSON.stringify(jwt.decode(cookie))}\n${cookie}`,
    )
    return { res: res.status(401).send({ error: 'Invalid JWT' }), valid: false }
}

Proposed Solution:

• Sanitize or avoid logging sensitive information within the JWT.
• Consider logging only non-sensitive metadata (e.g., error type, request origin) to help diagnose issues without exposing user data.

Impact: This change will reduce the risk of sensitive data exposure in logs, improving the security and privacy of user information.

[arianabuilds]

Entry Summary for HACK SIV @ DEF CON 2024

Thanks again for participating! This submission earned $22.68 from SIV and $57.14 from the Public Vote, for a total of $79.82.

Here's what we noted in our evaluation:

What takes away from it

• Unclear if/how to exploit

Issue to track getting paid: https://github.com/siv-org/hack.siv.org/issues/10