XXE and JSON Web Tokens Vulnerabilities | TryHackMe ZTH: Obscure Web Vulns

Introduction

In this video walk-through, we covered the last part of TryHackMe ZTH: Obscure Web Vulns room. We went over JWT and XML External Entity Vulnerabilities.

XXE

Certain applications will occasionally have you post an XML document to do an action. Improper handling of these XML documents can lead to what’s known as XML External Entity Injection(XXE). XXE is when an attacker is able to use the ENTITY feature of XML to load resources from outside the website directory, for example XXE would allow an attack to load the contents of /etc/passwd.

Since the application doesn’t necessarily have to return data, you may not be able to get the contents of the external entity; however, that doesn’t mean all hope is lost. If you’re really lucky you may be able to use the php expect module to get RCE anyway.

JWT

certain JWT libraries have another devastating vulnerability. There is actually three possible algorithms, two of them RS256 and HS256 which we have already studied. There is a third algorithm, known as None. According to the official JWT RFC the None algorithm is used when you still want to use JWT, however there is other security in place to stop people from spoofing data.

Unfortunately certain JWT libraries clearly didn’t read the RFC, allowing a vulnerability where an attacker can switch to the None algorithm, in the same way one switches to RS256 to HS255, and have the token be completely valid without even needing to calculate a secret.

Get OSCP Certificate Notes

Answers 

Video Walk-through

XXE