Out Of Bounds Write with Jwt Tokens

An out‑of‑bounds (OOB) write occurs when data is written past the end of an allocated buffer. In JWT handling this typically shows up when a developer manually decodes the Base64URL parts (header, payload, signature) into a fixed‑size array or string without checking the length of the input.

Consider a C‑like implementation that copies each JWT segment into a 256‑byte buffer:

char part[256];
strcpy(part, base64url_decode(jwt_segment)); // no length check

If an attacker supplies a JWT segment longer than 255 characters (plus the terminating null byte), strcpy will write beyond part, corrupting adjacent memory. This can lead to crashes, information disclosure, or arbitrary code execution depending on what lies after the buffer.

Real‑world examples include CVE‑2020‑15257 affecting the jsonwebtoken Node.js library prior to v8.5.1, where a malformed JWT triggered an OOB write during Base64URL decoding. Similar issues have been found in Go’s github.com/dgrijalva/jwt-go and PyJWT when developers rolled their own decoding routines.

Attack flow:

1. Attacker crafts a JWT with an excessively long header, payload, or signature (e.g., >1 KB).
2. Target service accepts the token and passes it to a vulnerable decoding routine.
3. The routine writes past the allocated buffer, overwriting function pointers, return addresses, or adjacent objects.
4. Depending on the memory layout, the attacker may achieve denial‑of‑service, leak secrets, or execute arbitrary code.

Because JWTs are often processed in high‑privilege paths (authentication, authorization), an OOB write here is especially dangerous.

Detecting an OOB write in JWT handling requires both static inspection of the code that processes tokens and dynamic observation of how the service reacts to anomalously sized tokens.

Static clues

• Direct use of strcpy, memcpy, sprintf, or similar functions on decoded JWT parts without explicit length limits.
• Manual Base64URL decoding loops that write into a fixed‑size array.
• Absence of length checks before copying (if (strlen(src) >= sizeof(dest)) error;).

Dynamic clues

• Service returns 500 Internal Server Error or crashes when presented with a JWT segment longer than a typical size (e.g., >500 bytes).
• Unexpected binary data in responses or logs indicating memory corruption.
• Fuzzing with progressively longer token parts triggers segmentation faults.

middleBrick’s unauthenticated black‑box scan can help surface this issue automatically. When you submit an API endpoint, middleBrick:

1. Generates a series of JWT‑like requests with inflated header, payload, and signature fields.
2. Monitors for error responses, connection resets, or timing anomalies that suggest a crash or OOB write.
3. Reports the finding under the "Input Validation" category with severity and remediation guidance.

Example CLI usage:

# Install the middleBrick CLI (npm)
npm i -g middlebrick
# Scan an auth endpoint that expects a JWT
middlebrick scan https://api.example.com/v1/auth/validate

The output includes a JSON report you can pipe into CI pipelines. In a GitHub Action you would add:

name: API Security Scan
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run middleBrick scan
        uses: middlebrick/action@v1
        with:
          api-url: https://staging.example.com/api
          fail-below: B   # fail if score drops below B

The MCP Server lets you trigger the same scan from inside an AI coding assistant (e.g., Claude or Cursor) so you can verify a fix before committing code.

The safest way to avoid OOB writes is to never manually decode JWT parts. Use a well‑maintained library that performs bounds‑checked Base64URL decoding and validates token structure.

Node.js (jsonwebtoken)

const jwt = require('jsonwebtoken');
const secret = process.env.JWT_SECRET;

function verifyToken(token) {
  try {
    // The library decodes and validates internally; no manual buffers
    const payload = jwt.verify(token, secret);
    return payload;
  } catch (err) {
    // Handle invalid token (malformed, expired, signature mismatch)
    throw new Error('Invalid token: ' + err.message);
  }
}

// Example usage
const token = req.headers.authorization?.split(' ')[1];
if (!token) throw new Error('Missing token');
const payload = verifyToken(token);
req.user = payload;

Python (PyJWT)

import jwt
from jwt.exceptions import InvalidTokenError

SECRET = os.getenv('JWT_SECRET')

def verify_token(token: str) -> dict:
    try:
        # PyJWT handles base64url decoding with proper length checks
        payload = jwt.decode(token, SECRET, algorithms=['HS256'])
        return payload
    except InvalidTokenError as exc:
        raise ValueError(f'Invalid token: {exc}')

# In a Flask view
@app.route('/protected')
def protected():
    auth = request.headers.get('Authorization', '')
    if not auth.startswith('Bearer '):
        abort(401)
    token = auth.split(' ')[1]
    payload = verify_token(token)
    return jsonify({'user': payload})

Go (github.com/golang-jwt/jwt/v4)

package main

import (
	"errors"
	"github.com/golang-jwt/jwt/v4"
)

var jwtSecret = []byte(os.Getenv("JWT_SECRET"))

func VerifyToken(tokenString string) (jwt.MapClaims, error) {
    token, err := jwt.Parse(tokenString, func(t *jwt.Token) (interface{}, error) {
        // Ensure the signing method is what we expect
        if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
            return nil, errors.New("unexpected signing method")
        }
        return jwtSecret, nil
    })
    if err != nil {
        return nil, err
    }
    if !token.Valid {
        return nil, errors.New("invalid token")
    }
    claims, ok := token.Claims.(jwt.MapClaims)
    if !ok {
        return nil, errors.New("invalid claims type")
    }
    return claims, nil
}

// HTTP handler
func ProtectedHandler(w http.ResponseWriter, r *http.Request) {
    auth := r.Header.Get("Authorization")
    if auth == "" {
        http.Error(w, "missing token", http.StatusUnauthorized)
        return
    }
    parts := strings.Split(auth, " ")
    if len(parts) != 2 || parts[0] != "Bearer" {
        http.Error(w, "malformed token", http.StatusUnauthorized)
        return
    }
    _, err := VerifyToken(parts[1])
    if err != nil {
        http.Error(w, err.Error(), http.StatusUnauthorized)
        return
    }
    w.WriteHeader(http.StatusOK)
}

Key remediation points:

• Never use strcpy, memcpy, sprintf, or similar on raw JWT segments.
• If you must decode manually (e.g., for debugging), first check the length of the Base64URL string against your buffer size and return an error if it exceeds it.
• Prefer libraries that constant‑time compare signatures and validate the alg header to prevent algorithm confusion.
• Keep dependencies updated; monitor security advisories for the JWT library you use (e.g., npm audit jsonwebtoken, pip list --outdated, go list -m -u all).

After fixing the code, run a middleBrick scan again (via CLI, GitHub Action, or MCP Server) to confirm the finding disappears and the security score improves.