Description

Identifies insecure JWT token parsing in Java applications using the JJWT library where signature verification may be bypassed. This can allow attackers to forge or tamper with JWT tokens, potentially leading to authentication bypasses or privilege escalation.

Detection Strategy

• Check if the JJWT library (io.jsonwebtoken or io.jsonwebtoken.Jwts) is imported in the Java code

• Look for calls to the 'parse' method from the JJWT library

• Verify if the parse operation is performed without proper signature verification configuration

• Report a vulnerability if JWT tokens are parsed without signature validation

Vulnerable code example

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.JwtParser;

public class JwtUnsafeParser {
    private static final String SECRET_KEY = "secret";
    
    public String parseJwtUnsafely(String token) {
        // VULNERABLE: Using .parse() skips signature validation...

✅ Secure code example

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.JwtParser;
import io.jsonwebtoken.security.Keys;
import javax.crypto.SecretKey;

public class JwtSafeParser {
    // Use a proper key size (at least 256 bits for HMAC)
    private static final SecretKey SECRET_KEY = Keys.hmacShaKeyFor("your-256-bit-secret".getBytes());...