Description

Identifies when JWT tokens are decoded without signature verification in Ruby applications. This creates a significant security risk as it allows attackers to tamper with JWT tokens since the cryptographic signature is not validated.

Detection Strategy

• Check if the 'jwt' library is imported in the Ruby code

• Look for calls to JWT.decode() method

• Verify if the third argument (verify parameter) is set to false

• Report a vulnerability when JWT token verification is explicitly disabled through the verify=false parameter

Vulnerable code example

require 'jwt'

def decode_token(token, secret)
  # Vulnerable: JWT verification disabled by setting verify=false
  decoded = JWT.decode(token, secret, false, { algorithm: 'HS256' })
  decoded[0]
end

✅ Secure code example

require 'jwt'

def decode_token(token, secret)
  # Safe: Enable JWT verification by setting verify=true to validate signature
  decoded = JWT.decode(token, secret, true, { algorithm: 'HS256' })
  decoded[0]
end