JSON Web Token

Azure Front Door edge actions are now available to you.

Uh, this supports edge actions, letting customers run JavaScript at the edge to inspect and manipulate requests before they hit the origin, including header manipulation, origin override logic, and lightweight JWT claims checking.

Edge actions are managed as standard lone Azure resources, uh, configured via Azure portal REST API or PowerShell modules.

The runtime is intentionally minimal with no outbound network access, no crypto libraries, and a 10-millisecond execution limit with fail-open behavior, meaning errors or timeouts result in requests passing through unprocessed.

Safe

...

this makes it suitable for claims pre-filtering, uh, but not full JWT signature validations.

Because edge actions cannot cryptographically verify tokens, actual authentication must still happen at the origin or another trusted gateway.

You are hired as a junior security analyst for a startup that publishes a public REST weather API.

This API exposes endpoints such as get/weather?city=, get/forecast?lat= and lon=, post/users, registration, post/login, authentication with JWT, get API keys, management of consumer API keys, and a premium tier accessible via API key plus rate limiting.

The API relies on a back-end service, a cache layer, Redis, a relational database, PostgreSQL, and calls one external third-party meteorological data provider.

The company wants a complete threat model before starting any pen test in order to prioritize security tests and corrections.

This mini-project directly reinforces the skill block, understand the risks of an application to prioritize tests and corrections, and prepares the pen test blocks that follow.

Scope.

In scope, all public and authenticated endpoints, the JWT auth/session flow, API key management, the cache and database interactions, and the outbound call to the third-party weather provider.

Out of scope, exploitation/live pen test.

And bearer tokens make it worse because they're inherently relayable.

There was a good discussion around Agent Passport earlier this year making the point that if Agent A presents his JWT to Skill B, Skill B can reuse that token to call Skill C while pretending to be Agent A.

Nothing stops it.

The token doesn't know who's holding it.

Another problem is that OAuth access tokens, which were sort of the way, if the inbound request was from, let's say, a mobile app or some other client, and you sent in the access token and then you use the access token within your network, right? A couple of things often happen.

One, lots of people were not using JWT based access tokens or ones that were adjacent and signed.

So you had to go back to the authorization server to validate the access token at each workload.

So that was one piece of it.

What is a transaction token? Just

plain terms.

Plain terms, a transaction token is technically a signed JWT, and it's intended to represent the transaction that's being requested.

So that could be something like transfer $100 from this account to that account.

Today, we have news of a much more popular framework, the Isabel framework, which is used, uh, to control, uh, PBXs, basically phone systems, via web applications.

Well, uh, this particular framework contained a hard-coded JWT key, so basically the secret key being used to sign these JSON web tokens.

With that key, it was possible to essentially bypass authentication.

The result was that you could actually execute arbitrary code on any kind of Asterix server that was linked to an Isabel framework front end.

[woshing sound] One shared key opens every Isabel door.

VulnCheck says attackers are exploiting a critical Isabel framework flaw caused by the same hard-coded JWT signing key appearing in every installation.

An unauthenticated attacker can forge a token and run operating system commands as the asterisk user.

Isabel patched the flaw August 1st, and the Shadow Server Foundation first observed exploitation September 9th.