Integer Overflow in Feathersjs with Jwt Tokens

An integer overflow in a Feathersjs application that uses Jwt tokens occurs when user-controlled numeric inputs involved in token handling are not properly bounded. For example, if a service accepts parameters such as expiresIn, maxAge, or custom numeric claims and passes them directly to JWT encoding functions without validation, an attacker can supply large values that overflow 32-bit integer limits. This can lead to unexpected behavior when the runtime computes expiration timestamps or performs arithmetic on these values.

Feathersjs typically integrates JWT handling via authentication hooks and configuration (e.g., @feathersjs/authentication-jwt). When a JWT is issued, the library may compute an expiration timestamp by adding a numeric expiresIn (in seconds or milliseconds) to the current time. If this value is user-supplied and not constrained, an integer overflow can produce a timestamp that either wraps to a distant past or an unrealistic future date. Runtime checks that compare token expiration to current time may then behave incorrectly, potentially accepting tokens that appear valid far into the future or rejecting valid tokens due to unexpected wrap-around.

Such overflow conditions can expose the unauthenticated attack surface that middleBrick scans, as malformed tokens might bypass intended expiration checks or cause erratic server-side behavior. While JWT signature verification remains intact, the semantic meaning of claims like exp can be subverted if numeric overflow leads to incorrect comparisons. Attack patterns resembling CVE-2021-23461-style time-based confusion can emerge when libraries perform unsafe arithmetic on 32-bit integers.

Because Feathersjs applications often rely on declarative hook flows, developers might assume framework protections mitigate numeric misuse. However, unless input validation explicitly constrains numeric fields used in JWT computations, the unauthenticated attack surface includes token issuance and verification endpoints. middleBrick’s checks for Input Validation and Authentication help surface misconfigurations where overflow-prone parameters are accepted without type or range checks.

Remediation focuses on validating and sanitizing all numeric inputs that influence JWT behavior, such as expiresIn, maxAge, and custom numeric claims. Use explicit integer parsing with safe ranges, and enforce upper bounds consistent with your security policy.

Example 1: Safe JWT issuance with bounded expiresIn

const jwt = require('@feathersjs/authentication-jwt');

app.configure(authentication({
  secret: process.env.JWT_SECRET,
  tokenOptions: {
    expiresIn: '15m' // Use fixed, short durations or read from a safe config
  }
}));

// If you must accept user-supplied duration, validate and clamp it
function parseExpiresIn(input) {
  const parsed = parseInt(input, 10);
  if (!Number.isFinite(parsed)) return 60; // default 60 seconds
  const max = 3600; // 1 hour cap to prevent overflow misuse
  return Math.min(parsed, max);
}

// Usage inside a custom hook or service method
app.service('tokens').hooks({
  before: {
    create(context) {
      const userSupplied = context.data.expiresIn;
      context.data.expiresIn = parseExpiresIn(userSupplied);
      return context;
    }
  }
});

Example 6: Validating numeric claims before encoding

const jwt = require('jsonwebtoken');

function createToken(payload, userInput) {
  // Ensure custom numeric claim is within safe integer range
  const safeValue = Number.isInteger(userInput.score) ? Math.max(0, Math.min(userInput.score, 10000)) : 0;

  const token = jwt.sign({
    ...payload,
    customScore: safeValue,
    exp: Math.floor(Date.now() / 1000) + 300 // 5 minutes, hardcoded or from config
  }, process.env.JWT_SECRET, { algorithm: 'HS256' });

  return token;
}

// In a Feathers hook
app.service('data').hooks({
  before: {
    create(context) {
      const token = createToken({ sub: context.data.userId }, context.data);
      context.result = { token };
      return context;
    }
  }
});

General defenses

• Treat all incoming numeric values as untrusted; parse with parseInt and validate against Number.isFinite.
• Apply conservative upper bounds (e.g., max session duration) and prefer fixed durations from configuration over user input.
• Use BigInt only if necessary and ensure runtime checks prevent conversion errors that could affect downstream time comparisons.
• Combine these measures with OWASP API Top 10 coverage for Security Misconfiguration and Excessive Data Exposure, as unchecked numeric fields can leak internal logic via error messages or token metadata.