Open righettod opened 2 years ago
Hi,
After reading this blog post about the CVE-2022-21449, I was wondering if it can be interesting to add a test case with a JWT token for which the signature will be filled with 0 and the algorithm will be ES256, ES256K, ES384 or ES512 (see here)?
Example:
eyJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJURVNUIn0.MAYCAQACAQA
Sample vulnerable app:
https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/jwt-null-signature-vulnerable-app
It is just a suggestion so feel free to close this issue if it is not relevant 😃
PR #69 proposed to add this test 😃
Hi,
After reading this blog post about the CVE-2022-21449, I was wondering if it can be interesting to add a test case with a JWT token for which the signature will be filled with 0 and the algorithm will be ES256, ES256K, ES384 or ES512 (see here)?
Example:
Sample vulnerable app:
https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/jwt-null-signature-vulnerable-app
It is just a suggestion so feel free to close this issue if it is not relevant 😃