Hallucination Attacks with Jwt Tokens

Hallucination attacks in JWT contexts occur when an AI system generates or validates tokens based on faulty reasoning, leading to incorrect token generation, validation, or authorization decisions. These attacks exploit the AI's tendency to hallucinate token structures, claims, or validation logic.

Common manifestations include:

• Malformed Token Generation: AI systems hallucinating JWT structures may generate tokens with incorrect header formats, missing required claims, or invalid base64 encoding. For example, an AI might hallucinate a token like eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ== but with incorrect signature padding or missing expiration claims.
• Invalid Claim Validation: During token validation, hallucination can cause the AI to incorrectly validate claims. An AI might hallucinate that a token with an expired exp claim is still valid, or fail to check the aud (audience) claim against the expected value.
• Algorithm Confusion: The AI might hallucinate the signing algorithm, accepting none algorithms when HS256 was expected, or incorrectly validating RS256 tokens with HS256 verification keys.
• Role Escalation via Claim Injection: Hallucination can lead to AI systems incorrectly parsing or trusting claims like role, permissions, or groups, allowing attackers to escalate privileges by injecting fake claims.

Here's a vulnerable implementation showing hallucination risk:

// Vulnerable JWT handling with potential hallucination issues
const jwt = require('jsonwebtoken');

async function processToken(token) {
  try {
    // AI might hallucinate token structure and skip validation
    const decoded = jwt.decode(token, { complete: true });
    
    // Hallucination: AI assumes claims exist without validation
    const userId = decoded.payload.sub;
    const role = decoded.payload.role || 'user'; // Defaulting without checking
    
    // Critical flaw: no signature verification performed
    if (role === 'admin') {
      return await performAdminAction(userId);
    }
    return await performUserAction(userId);
  } catch (error) {
    console.log('Token processing error:', error.message);
    return null;
  }
}

The hallucination vulnerability here is that the AI system might incorrectly assume the token is valid after decoding, skipping signature verification entirely. This allows attackers to modify token contents without detection.

Detecting hallucination attacks in JWT contexts requires both runtime monitoring and automated scanning. middleBrick's JWT-specific detection includes:

• Signature Verification Testing: middleBrick tests whether your endpoints properly verify JWT signatures. It sends tokens with modified signatures to check if they're accepted, detecting hallucination-based validation bypasses.
• Claim Validation Analysis: The scanner examines whether your API validates critical claims like exp, nbf, aud, and iss. It tests with expired tokens, tokens with future nbf values, and tokens with mismatched audiences.
• Algorithm Confusion Testing: middleBrick tests for algorithm confusion vulnerabilities by sending tokens signed with none algorithms and tokens with mismatched signing keys.
• Property Authorization Scanning: The scanner checks if your API properly authorizes based on token claims, testing for privilege escalation through modified role or permission claims.

middleBrick's JWT-specific checks include:

{
  "jwt_security_checks": {
    "signature_verification": "FAIL",
    "critical_claims_validation": "PASS",
    "algorithm_validation": "FAIL",
    "claim_authorization": "FAIL",
    "token_structure_validation": "PASS"
  },
  "findings": [
    {
      "severity": "HIGH",
      "title": "Missing JWT Signature Verification",
      "description": "API accepts JWT tokens without verifying the signature, allowing token tampering.",
      "remediation": "Always verify JWT signatures using the correct secret or public key before processing claims.",
      "impact": "Attackers can modify token contents and escalate privileges."
    }
  ]
}

Additional detection techniques include:

• Runtime Monitoring: Log and monitor JWT validation failures, unexpected claim values, and algorithm mismatches.
• Input Validation: Validate JWT structure before processing, checking for proper base64 encoding and claim formatting.
• Algorithm Whitelisting: Only allow specific algorithms (HS256, RS256) and reject none algorithms entirely.

Remediating hallucination vulnerabilities in JWT handling requires implementing proper validation and verification patterns. Here are Jwt Tokens-specific fixes:

1. Proper Signature Verification

const jwt = require('jsonwebtoken');

// Secure JWT verification function
async function verifyToken(token, publicKey) {
  try {
    // Always verify signature with the correct key
    const decoded = jwt.verify(token, publicKey, {
      algorithms: ['RS256'], // Whitelist allowed algorithms
      issuer: 'your-issuer',
      audience: 'your-audience'
    });
    
    // Validate critical claims
    if (decoded.exp < Date.now() / 1000) {
      throw new Error('Token expired');
    }
    
    return decoded;
  } catch (error) {
    // Handle verification failures securely
    if (error.name === 'JsonWebTokenError' || 
        error.name === 'TokenExpiredError' ||
        error.name === 'NotBeforeError') {
      throw new Error('Invalid token: ' + error.message);
    }
    throw error;
  }
}

2. Claim Validation and Authorization

async function authorizeUser(token) {
  try {
    const decoded = await verifyToken(token, process.env.PUBLIC_KEY);
    
    // Validate required claims exist
    if (!decoded.sub || !decoded.role) {
      throw new Error('Missing required claims');
    }
    
    // Role-based access control with proper validation
    const userRole = decoded.role.toLowerCase();
    const requiredRole = 'admin';
    
    if (userRole !== requiredRole) {
      throw new Error('Insufficient permissions');
    }
    
    return decoded.sub;
  } catch (error) {
    console.error('Authorization failed:', error.message);
    throw error;
  }
}

3. Algorithm Whitelisting and Key Management

const jwt = require('jsonwebtoken');

// Secure JWT middleware with algorithm whitelisting
function jwtMiddleware(req, res, next) {
  const authHeader = req.headers.authorization;
  
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'Missing token' });
  }
  
  const token = authHeader.substring(7);
  
  try {
    // Verify with specific algorithm and key
    const decoded = jwt.verify(token, process.env.JWT_SECRET, {
      algorithms: ['HS256'], // Only allow HS256
      issuer: 'your-issuer',
      audience: 'your-audience'
    });
    
    // Attach user info to request
    req.user = decoded;
    next();
  } catch (error) {
    console.error('JWT verification error:', error.message);
    res.status(401).json({ error: 'Invalid token' });
  }
}

4. Comprehensive Validation Pipeline

class JwtValidator {
  constructor(secretOrKey, options = {}) {
    this.secretOrKey = secretOrKey;
    this.options = {
      algorithms: ['RS256'],
      issuer: 'your-issuer',
      audience: 'your-audience',
      ...options
    };
  }
  
  async validate(token) {
    if (!token || typeof token !== 'string') {
      throw new Error('Token must be a non-empty string');
    }
    
    try {
      // Verify signature and decode
      const decoded = jwt.verify(token, this.secretOrKey, this.options);
      
      // Additional structural validation
      if (!decoded.header || !decoded.payload) {
        throw new Error('Invalid token structure');
      }
      
      // Validate specific claims
      this.validateClaims(decoded.payload);
      
      return decoded;
    } catch (error) {
      this.handleValidationError(error);
      throw error;
    }
  }
  
  validateClaims(payload) {
    const now = Math.floor(Date.now() / 1000);
    
    // Check expiration
    if (payload.exp < now) {
      throw new Error('Token expired');
    }
    
    // Check not before
    if (payload.nbf > now) {
      throw new Error('Token not active yet');
    }
    
    // Validate issuer and audience
    if (payload.iss !== this.options.issuer) {
      throw new Error('Invalid issuer');
    }
    
    if (payload.aud !== this.options.audience) {
      throw new Error('Invalid audience');
    }
  }
  
  handleValidationError(error) {
    // Log security-relevant information
    console.warn('JWT validation failed:', {
      errorName: error.name,
      errorMessage: error.message,
      timestamp: new Date().toISOString()
    });
  }
}