Use After Free with Jwt Tokens

Use After Free vulnerabilities in JWT implementations typically occur when token validation logic references memory or objects that have been deallocated or modified after initial use. In JWT contexts, this often manifests through improper handling of token lifecycle events and state management.

One common Jwt Tokens-specific pattern involves token revocation lists. Consider this vulnerable implementation:

const revokedTokens = new Set();

function validateToken(token) {
  const decoded = jwt.decode(token);
  
  // Token is verified but revocation check happens separately
  if (revokedTokens.has(decoded.jti)) {
    throw new Error('Token revoked');
  }
  
  return decoded;
}

// Race condition: token is validated, then immediately removed from revocation list
function processRequest(req) {
  const token = req.headers.authorization.split(' ')[1];
  const payload = validateToken(token);
  
  // Critical flaw: token revocation check is bypassed if token is removed between validation and use
  revokedTokens.delete(payload.jti);
  
  return { userId: payload.sub, action: 'processed' };
}

The vulnerability here is that the token is validated against the revocation list, but then the revocation check is bypassed by removing the token before it's actually used. The memory reference to the token's state becomes stale after deletion.

Another Jwt Tokens-specific Use After Free pattern occurs with token refresh mechanisms:

class TokenManager {
  constructor() {
    this.activeTokens = new Map();
  }
  
  async createToken(userId) {
    const token = jwt.sign({ sub: userId }, 'secret', { expiresIn: '1h' });
    this.activeTokens.set(token, { userId, createdAt: Date.now() });
    return token;
  }
  
  async refreshToken(oldToken) {
    const payload = jwt.verify(oldToken, 'secret');
    
    // Token is validated but reference to old token state is freed
    this.activeTokens.delete(oldToken);
    
    // Use After Free: oldToken payload might be used after deletion
    return this.createToken(payload.sub);
  }
}

In this Jwt Tokens implementation, the old token's state is removed from tracking before the new token is created, creating a window where the old token's metadata could be accessed after being freed.

Database-backed token storage introduces similar issues:

async function validateAndUseToken(token) {
  const decoded = jwt.decode(token);
  const tokenRecord = await db.tokens.findOne({ jti: decoded.jti });
  
  // Token is validated but record might be deleted before use
  if (!tokenRecord || tokenRecord.revoked) {
    throw new Error('Invalid token');
  }
  
  // Critical flaw: token record is deleted before actual use
  await db.tokens.deleteOne({ jti: decoded.jti });
  
  // Use After Free: tokenRecord might be accessed after deletion
  return { userId: tokenRecord.userId, sessionData: tokenRecord.data };
}

The Jwt Tokens-specific nature of these vulnerabilities stems from the stateless design philosophy of JWTs conflicting with stateful security requirements like revocation and session management.

Detecting Use After Free vulnerabilities in JWT implementations requires examining both code patterns and runtime behavior. Here's how to identify these issues specifically in Jwt Tokens contexts:

Code Analysis Patterns

Look for these Jwt Tokens-specific code patterns that indicate potential Use After Free vulnerabilities:

// Pattern 1: Premature token state deletion
function authenticate(token) {
  const payload = jwt.verify(token, 'secret');
  
  // Deletion happens before token is fully processed
  tokenStore.remove(token);
  
  return { userId: payload.sub, session: getSessionData(payload.sub) };
}

// Pattern 2: Race conditions in token validation
async function validateWithRevocation(token) {
  const decoded = jwt.decode(token);
  const isValid = await checkRevocation(decoded.jti);
  
  // State change between validation and use
  if (isValid) {
    markTokenUsed(decoded.jti);
  }
  
  // Use After Free: token state might change after validation
  return decoded;
}

Runtime Detection with middleBrick

middleBrick's Jwt Tokens-specific scanning identifies Use After Free vulnerabilities through black-box testing of token lifecycle management:

middleBrick's Jwt Tokens-specific detection includes:

# middleBrick CLI output for Use After Free detection
$ middlebrick scan https://api.example.com/auth

=== JWT Security Analysis ===

Use After Free Vulnerability Detected:
- Endpoint: POST /refresh-token
- Risk: HIGH
- Description: Token revocation check bypassed due to premature state deletion
- Remediation: Ensure token state remains consistent throughout validation and use

=== Detailed Findings ===

1. Token Lifecycle Race Condition
   Severity: HIGH
   Location: auth/refresh
   Issue: Token revocation state changed between validation and use
   Recommendation: Atomic token validation and state management

The scanner tests Jwt Tokens endpoints by submitting tokens through various lifecycle stages, monitoring for inconsistent state handling and memory reference issues.

Remediating Use After Free vulnerabilities in JWT implementations requires Jwt Tokens-specific patterns that ensure consistent state management throughout the token lifecycle. Here are proven fixes:

Atomic Token Validation Pattern

The most effective Jwt Tokens-specific remediation is atomic validation that prevents state changes during processing:

class SecureTokenManager {
  constructor() {
    this.tokenLocks = new Map();
  }
  
  async validateToken(token) {
    const decoded = jwt.decode(token);
    const jti = decoded.jti;
    
    // Atomic lock to prevent state changes during validation
    if (this.tokenLocks.has(jti)) {
      throw new Error('Token already being processed');
    }
    
    this.tokenLocks.set(jti, true);
    
    try {
      // Single atomic operation: validate and check revocation
      const isValid = await this.verifyAndCheckRevocation(token);
      
      if (!isValid) {
        throw new Error('Invalid or revoked token');
      }
      
      // Token state remains consistent throughout
      return decoded;
    } finally {
      this.tokenLocks.delete(jti);
    }
  }
  
  async verifyAndCheckRevocation(token) {
    // Jwt Tokens-specific: single verification with all checks
    const payload = jwt.verify(token, 'secret');
    
    // Atomic revocation check
    const isRevoked = await db.revocation.findOne({ jti: payload.jti });
    if (isRevoked) {
      return false;
    }
    
    return true;
  }
}

Immutable Token State Pattern

Another Jwt Tokens-specific remediation ensures token state cannot be modified after validation:

function createImmutableTokenValidator(secret) {
  return function validateToken(token) {
    // Jwt Tokens-specific: verify with strict options
    const payload = jwt.verify(token, secret, {
      algorithms: ['HS256', 'RS256'],
      maxAge: '1h',
      ignoreExpiration: false
    });
    
    // Create immutable token record
    const tokenRecord = Object.freeze({
      token: token,
      payload: payload,
      validatedAt: new Date(),
      isValid: true
    });
    
    // Store in secure, non-modifiable structure
    secureStore.set(payload.jti, tokenRecord);
    
    return tokenRecord;
  };
}

// Usage: immutable token cannot be modified after creation
const validate = createImmutableTokenValidator('secret-key');
const tokenRecord = validate(jwtToken);

try {
  // Any attempt to modify throws TypeError
  tokenRecord.isValid = false; // Fails
} catch (e) {
  console.error('Token state is immutable');
}

Database Transaction Pattern

For Jwt Tokens implementations using database-backed token management:

async function validateWithTransaction(token) {
  const decoded = jwt.decode(token);
  
  // Database transaction ensures atomicity
  return await db.transaction(async (trx) => {
    // Lock token row to prevent concurrent modification
    const tokenRecord = await trx.tokens.forUpdate().findOne({
      jti: decoded.jti
    });
    
    if (!tokenRecord || tokenRecord.revoked) {
      throw new Error('Invalid token');
    }
    
    // Jwt Tokens-specific: verify signature within transaction
    try {
      jwt.verify(token, tokenRecord.secret);
    } catch (verifyError) {
      throw new Error('Token verification failed');
    }
    
    // Return token data without exposing mutable state
    return {
      userId: tokenRecord.userId,
      permissions: tokenRecord.permissions,
      metadata: { ...tokenRecord.metadata }
    };
  });
}

Middleware-Based Protection

Implement Jwt Tokens-specific middleware to prevent Use After Free across your API:

const tokenValidationMiddleware = (secret) => {
  return async (req, res, next) => {
    try {
      const authHeader = req.headers.authorization;
      if (!authHeader) {
        return res.status(401).json({ error: 'Missing token' });
      }
      
      const token = authHeader.split(' ')[1];
      
      // Jwt Tokens-specific: comprehensive validation
      const payload = jwt.verify(token, secret, {
        algorithms: ['HS256'],
        complete: true
      });
      
      // Create protected token context
      req.tokenContext = Object.freeze({
        token: token,
        payload: payload,
        isValid: true,
        userId: payload.payload.sub
      });
      
      next();
    } catch (error) {
      return res.status(401).json({
        error: 'Token validation failed',
        details: error.message
      });
    }
  };
};

// Usage in Express
app.use('/api/protected', tokenValidationMiddleware('secret'), (req, res) => {
  // req.tokenContext is guaranteed to be valid and immutable
  res.json({ userId: req.tokenContext.userId });
});