Disallow parsing of token with none signature in authenticateToken #9172
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sijie
approved these changes
Jan 11, 2021
|
/pulsarbot run-failure-checks |
sijie
added
area/security
release/2.7.1
type/bug
sijie
requested review from
jiazhai,
315157973,
codelipenghui,
hangc0276 and
tuteng
|
/pulsarbot run-failure-checks |
315157973
reviewed
Jan 12, 2021
|
@315157973 Great catch! @nodece Can you add a flag to turn this validation on/off? |
nodece
force-pushed
the
disable_none_alg
branch
2 times, most recently
from
5942092
to
a5b7ebd
Compare
hangc0276
approved these changes
Jan 12, 2021
|
/pulsarbot run-failure-checks |
1 similar comment
|
/pulsarbot run-failure-checks |
|
@hangc0276 |
|
@sijie |
|
/pulsarbot run-failure-checks |
3 similar comments
|
/pulsarbot run-failure-checks |
|
/pulsarbot run-failure-checks |
|
/pulsarbot run-failure-checks |
|
@nodece Please rebase the master branch |
nodece
force-pushed
the
disable_none_alg
branch
from
a5b7ebd
to
7721023
Compare
|
/pulsarbot run-failure-checks |
nodece
force-pushed
the
disable_none_alg
branch
from
7721023
to
71a484d
Compare
|
/pulsarbot run-failure-checks |
Signed-off-by: Zixuan Liu <nodeces@gmail.com>
nodece
force-pushed
the
disable_none_alg
branch
from
71a484d
to
94247da
Compare
|
/pulsarbot run-failure-checks |
1 similar comment
|
/pulsarbot run-failure-checks |
codelipenghui
approved these changes
Feb 8, 2021
tuteng
approved these changes
Feb 8, 2021
|
All tests has been passed. |
|
@nodece Awesome contribution! |
codelipenghui
pushed a commit
that referenced
this pull request
Feb 18, 2021
…9172) Signed-off-by: Zixuan Liu <nodeces@gmail.com> ### Motivation If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins). ### Modifications - using `parseClaimsJws` instead of `parse` `parseClaimsJws` can guarantees the correct security model for parsing signed JWTs. (cherry picked from commit 71bc841)
1 task
cdbartholomew
pushed a commit
to kafkaesque-io/pulsar
that referenced
this pull request
May 25, 2021
…pache#9172) Signed-off-by: Zixuan Liu <nodeces@gmail.com> ### Motivation If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins). ### Modifications - using `parseClaimsJws` instead of `parse` `parseClaimsJws` can guarantees the correct security model for parsing signed JWTs.
eolivelli
pushed a commit
that referenced
this pull request
May 26, 2021
…9172) Signed-off-by: Zixuan Liu <nodeces@gmail.com> ### Motivation If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins). ### Modifications - using `parseClaimsJws` instead of `parse` `parseClaimsJws` can guarantees the correct security model for parsing signed JWTs. (cherry picked from commit 71bc841)
eolivelli
pushed a commit
to datastax/pulsar
that referenced
this pull request
May 26, 2021
…pache#9172) Signed-off-by: Zixuan Liu <nodeces@gmail.com> ### Motivation If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins). ### Modifications - using `parseClaimsJws` instead of `parse` `parseClaimsJws` can guarantees the correct security model for parsing signed JWTs. (cherry picked from commit 71bc841)
lhotari
pushed a commit
to lhotari/pulsar
that referenced
this pull request
May 26, 2021
…pache#9172) Signed-off-by: Zixuan Liu <nodeces@gmail.com> ### Motivation If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins). ### Modifications - using `parseClaimsJws` instead of `parse` `parseClaimsJws` can guarantees the correct security model for parsing signed JWTs. (cherry picked from commit 71bc841)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Signed-off-by: Zixuan Liu nodeces@gmail.com
Motivation
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).
Modifications
parseClaimsJwsinstead ofparseparseClaimsJwscan guarantees the correct security model for parsing signed JWTs.Verifying this change