SD-JWT: VerifiedSDJWT::getIssuerSignedJwt() keeps the signatures the loader did not verify

Aperta
  • Qualcosa non va?
#765 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
php
Ambito
backend-api-design, security

Direzione di ricerca

Start by reading SDJWTVerifier::process() and trace how LoadingResult::getSignatureIndex() is used when the JWS is verified and returned. Review JsonSerializationTest::aGeneralSdJwtIsVerifiedByAnyOfItsSignatures; add coverage for a prepended unsigned signature and update the expectation for the returned verified JWT. Done means the returned issuer-signed JWT exposes the verified signature first, while the presented SD-JWT remains available through getSdJwt().

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
Version(s) affected

4.3.x-dev and 5.0.x-dev (unreleased), since #750

Description

When the loader of the Issuer-signed JWT accepts the general JWS JSON serialization, SDJWTVerifier::verify() and verifyWithKeyBinding() return the whole JWS in VerifiedSDJWT::getIssuerSignedJwt(), every signature included, although only one of them was verified. Whoever holds the SD-JWT can put an entry of their own in front of the Issuer's signature: the protected header at index 0 of the "verified" Issuer-signed JWT is then theirs (typ, kid, x5c…), including a typ that the configured TypeChecker refuses.

The claims, the header checkers and the algorithm check still apply to the signature that was verified, so no token is accepted that should be refused. The impact is on applications that read a header parameter of the result to branch or to attribute the issuer.

Conditions: the loader has JSONGeneralSerializer (jws_json_general in the bundle, whose default is compact only). With key binding, only the Holder can do it, because sd_hash covers the first signature.

How to reproduce
  1. Issue a compact SD-JWT whose protected header is {"alg":"ES256","typ":"visitor+sd-jwt","kid":"issuer-2026"}.
  2. Rewrite it as a general JSON SD-JWT whose signatures start with {"protected": b64u({"alg":"ES256","typ":"staff+sd-jwt","kid":"chosen-by-the-holder"}), "header": {"disclosures": [...]}, "signature": b64u(64 arbitrary bytes)}, followed by the Issuer's entry.
  3. Verify it with a loader that has the compact, flattened and general serializers, ES256 and TypeChecker(['visitor+sd-jwt']).

The token is accepted with the Issuer's claims, the loader reports signature index 1, and getIssuerSignedJwt()->getSignature(0)->getProtectedHeader() is the header written by the holder.

Possible Solution

SDJWTVerifier::process() uses LoadingResult::getSignatureIndex() for its algorithm check, then returns $loaded->getJws() and drops the index. Return $loaded->getJws()->split()[$loaded->getSignatureIndex()] instead, so that signature 0 is the verified one in every serialization; the token as presented stays available from getSdJwt().

Also:

  • say in the docblock of getIssuerSignedJwt() and in the documentation that only the protected header is authenticated (the unprotected header of the verified entry can be changed by anyone, in the flattened serialization too);
  • update JsonSerializationTest::aGeneralSdJwtIsVerifiedByAnyOfItsSignatures, which expects two signatures, and add a test with a prepended unsigned entry.
Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-MHZ2TD30). To be fixed before 4.3.0.

Lingua principale
PHP
Stelle
954
Fork
119
Merge medio
48m
PR unite (30g)
17

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di web-token/jwt-framework

Tutte le issue di web-token/jwt-framework

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.