Amazon AppSec CTF : HalCrypto

contact@rodolpheg.xyz (0xRo) — Sun, 21 Sep 2025 00:00:00 +0000

Synthese

Challenge : HalCrypto
Categorie : Securite Web
Vulnerabilite : Contournement de la validation JWT via confusion d’URL avec le symbole @
Impact : Contournement de l’authentification menant a un acces administrateur
Flag : HTB{r3d1r3c73d_70_my_s3cr37s}

Vue d’ensemble de la vulnerabilite

Diagramme du flux d’attaque

graph TD
 A[User Login + Attacker JWT] --> B[AuthMiddleware]
 B --> C[Extract JKU URL from Header]
 C --> D{Validate JKU URL<br/>lastIndexOf check}
 D -->|"URL starts with AUTH_PROVIDER<br/>string-based comparison"| E[PASSES]
 D -->|"Does not start with AUTH_PROVIDER"| R[Rejected]

 E --> F["Fetch JWKS from JKU URL"]
 F --> G["JWT Verification with<br/>attacker's public key"]
 G --> H[Auth Bypass]
 H --> I[Flag]

 subgraph "URL Confusion"
 J["Validator sees:<br/>http://127.0.0.1:1337@attacker.com/...<br/>starts with AUTH_PROVIDER ✓"]
 K["HTTP client connects to:<br/>attacker.com<br/>treats 127.0.0.1:1337 as credentials"]
 end

 D -.-> J
 F -.-> K

Analyse source-to-sink

1. Point d’entree - Authentification JWT (Source)

La vulnerabilite commence lorsque le AuthMiddleware traite les tokens JWT :

JWT on RORO's blog

Amazon AppSec CTF : HalCrypto

Synthese

Vue d’ensemble de la vulnerabilite

Diagramme du flux d’attaque

Analyse source-to-sink

1. Point d’entree - Authentification JWT (Source)