Beast Attack with Jwt Tokens

The BEAST (Browser Exploit Against SSL/TLS) attack targets CBC-mode encryption by exploiting the way initialization vectors (IVs) are chained across blocks. When a JWT is encrypted as a JWE using AES‑CBC (e.g., enc: A128CBC-HS256 or enc: A256CBC-HS512), the same vulnerability can be leveraged against the token itself. An attacker who can obtain or inject ciphertext blocks and observe whether a server accepts the resulting token can gradually decrypt the plaintext claims.

Typical vulnerable code paths appear when a library is configured to use CBC mode for JWE encryption. For example, in Node.js with the node-jose package:

const jose = require('node-jose');
// Vulnerable: explicitly requesting CBC mode
const encrypt = async (payload) => {
  return await jose.JWE.createEncrypt({ format: 'compact', contentAlg: 'A128CBC-HS256' })
    .update(JSON.stringify(payload))
    .final();
};

Or in Python with PyJWT combined with cryptography when the developer mistakenly selects "A128CBC-HS256" as the encryption algorithm:

import jwt
# Vulnerable: using CBC mode for JWE
token = jwt.encode(payload, key, algorithm='dir', enc='A128CBC-HS256')

If an API returns such a token in an unauthenticated response (e.g., a login endpoint), middleBrick’s black‑box scan can detect the CBC‑mode indicator in the JWT header and flag the endpoint as susceptible to a BEAST‑style adaptive chosen‑ciphertext attack.

middleBrick performs unauthenticated API scanning and inspects any JWTs it encounters. During the scan it:

• Extracts the JWT from response bodies, headers, or cookies.
• Parses the JWT header (base64url‑decoded) and looks for the enc parameter.
• Matches the value against a list of known CBC‑mode JWE encryption algorithms: A128CBC-HS256, A192CBC-HS384, A256CBC-HS512.
• If a match is found, the scanner raises a finding under the "Encryption" category with a severity of High.

Example CLI usage:

middlebrick scan https://api.example.com/auth --output json

The resulting JSON might contain:

Because middleBrick requires no agents, credentials, or configuration, the detection works simply by submitting the API URL. The finding includes remediation guidance (see next section) and maps to OWASP API Security Top 10 2023 – A3: Broken Object Property Authorization and A2: Broken Authentication (when encryption flaws lead to token disclosure).

The fix is to avoid CBC‑mode encryption for JWTs altogether. Use authenticated encryption with associated data (AEAD) algorithms such as A256GCM or A128GCM, or rely on signing only (JWS) when confidentiality is not required.

Node.js (using the jose library, which is the actively maintained successor to node-jose):

const { encryptJwt, decryptJwt } = require('jose');

// Secure: use dir + A256GCM (AEAD)
const createSecureToken = async (payload) => {
  const secret = new TextEncoder().encode('your-256-bit-secret');
  return await new encryptJwt(new TextEncoder().encode(JSON.stringify(payload)))
    .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
    .encrypt(secret);
};

// Decryption example
const verifyToken = async (jwt) => {
  const secret = new TextEncoder().encode('your-256-bit-secret');
  const { plaintext } = await new decryptJwt(jwt).decrypt(secret);
  return JSON.parse(new TextDecoder().decode(plaintext));
};

Python (using PyJWT with cryptography for JWE):

import jwt
from jwt.algorithms import RSAAlgorithm
from cryptography.hazmat.primitives import serialization

# Secure: use dir + A256GCM
private_pem = open('private_key.pem').read()
private_key = serialization.load_pem_private_key(private_pem.encode(), password=None)

token = jwt.encode(
    payload={'sub': '1234567890', 'name': 'Alice', 'iat': 1516239022},
    key=private_key,
    algorithm='dir',          # direct key encryption
    enc='A256GCM'             # AEAD encryption
)
print(token)

If the application does not need to encrypt the JWT at all, switch to a signed JWT (JWS) using an algorithm like HS256 or RS256:

const jwt = require('jsonwebtoken');
const token = jwt.sign({ userId: 42 }, 'strong-secret', { algorithm: 'HS256' });

After applying the fix, rescan the API with middleBrick (or rely on continuous monitoring in the Pro plan) to confirm that the "Encryption" finding disappears and the security score improves.