Description

This vulnerability detector identifies JWT parsers created without claims validation in Go applications using the jwt-go library. When JWT tokens are parsed without validating their claims (like expiration dates, audience, issuer), the application becomes vulnerable to various token-based attacks including replay attacks and privilege escalation.

Detection Strategy

• The detector first checks if the jwt-go library is imported with the expected prefix pattern

• It searches for calls to NewParser method from the jwt-go library alias

• It examines each NewParser call to determine if claims validation is disabled or missing

• A vulnerability is reported when NewParser is instantiated without proper claims validation configured

Vulnerable code example

package main

import (
	"net/http"
	"github.com/golang-jwt/jwt/v5"
)

func vulnerableJWT(r *http.Request) {...

✅ Secure code example

package main

import (
	"net/http"
	"github.com/golang-jwt/jwt/v5"
)

func secureJWT(r *http.Request) {...