Container Escape with Jwt Tokens

Fixing JWT validation to prevent privilege escalation and subsequent container escape involves using the library’s verification features correctly and enforcing strict claim checks. Below are language‑specific examples that demonstrate the safe patterns.

Node.js (jsonwebtoken)

Incorrect (vulnerable) code that accepts any token:

const jwt = require('jsonwebtoken');
function auth(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  try {
    // ❌ No verification – just decodes
    const payload = jwt.decode(token);
    req.user = payload;
    next();
  } catch (err) {
    res.status(401).send('Invalid token');
  }
}

Correct implementation:

const jwt = require('jsonwebtoken');
const SECRET = process.env.JWT_SECRET; // strong, random value
function auth(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return res.status(401).send('Missing token');

  try {
    const payload = jwt.verify(token, SECRET, {
      // Enforce algorithm – reject "none"
      algorithms: ['HS256'],
      // Validate standard claims
      issuer: 'https://auth.example.com',
      audience: 'https://api.example.com',
      // Optional: enforce expiration leeway
      clockTimestamp: Math.floor(Date.now() / 1000)
    });
    // Additional application‑specific claims
    if (!payload.groups || !payload.groups.includes('system:masters')) {
      return res.status(403).send('Insufficient privileges');
    }
    req.user = payload;
    next();
  } catch (err) {
    // Distinguish token errors from other failures
    if (err.name === 'JsonWebTokenError') {
      return res.status(401).send('Invalid token');
    }
    if (err.name === 'TokenExpiredError') {
      return res.status(401).send('Token expired');
    }
    return res.status(400).send('Bad request');
  }
}

Python (PyJWT)

Incorrect (vulnerable) code:

import jwt
from flask import request, abort

def require_auth():
    auth = request.headers.get('Authorization', '')
    if not auth.startswith('Bearer '):
        abort(401)
    token = auth.split(' ')[1]
    # ❌ No verification
    payload = jwt.decode(token, options={"verify_signature": False})
    request.user = payload

Correct implementation:

import jwt
from flask import request, abort

SECRET = os.environ.get('JWT_SECRET')  # must be strong

def require_auth():
    auth = request.headers.get('Authorization', '')
    if not auth.startswith('Bearer '):
        abort(401, 'Missing Bearer token')
    token = auth.split(' ')[1]

    try:
        payload = jwt.decode(
            token,
            SECRET,
            algorithms=['HS256'],  # reject "none"
            issuer='https://auth.example.com',
            audience='https://api.example.com',
            leeway=10  # small clock skew tolerance
        )
        # Enforce custom claim
        groups = payload.get('groups', [])
        if 'system:masters' not in groups:
            abort(403, 'Insufficient privileges')
        request.user = payload
    except jwt.InvalidTokenError as e:
        abort(401, f'Invalid token: {str(e)}')

Additional hardening steps that apply regardless of language:

• Use a strong, randomly generated secret (minimum 32 bytes for HS256) or, preferably, an asymmetric key pair (RS256/ECDSA) where the public key is stored securely and never exposed to clients.
• Rotate secrets periodically and invalidate old tokens via a token revocation list or short expiration times (exp ≤ 15 min) combined with refresh tokens.
• Avoid using the kid header to reference file paths; if a key ID is needed, map it to a known key identifier in a secure key store.
• Log authentication failures (including malformed tokens) and monitor for spikes that may indicate brute‑force or algorithm‑confusion attempts.
• Regularly scan the endpoint with middleBrick (via CLI, GitHub Action, or the MCP Server) to ensure that any regression in JWT handling is caught early.

By applying these fixes, the service will correctly reject forged tokens that attempt to map to privileged Kubernetes subjects, thereby removing the pathway that attackers use to achieve container escape via JWT misuse.