Jwt Cracking in Axum

JSON Web Tokens (JWTs) are commonly used for authentication in Rust web frameworks, including Axum. When JWT verification is misconfigured, attackers may attempt to forge or crack tokens to gain unauthorized access. In Axum, this often occurs when developers bypass cryptographic validation, use weak signing keys, or rely on insecure token parsing libraries. Attackers may exploit these weaknesses through brute-force attacks on weak secrets or by manipulating header values to bypass signature checks.

Common patterns include missing signature validation, acceptance of untrusted token claims, and improper handling of token expiration. These issues expose APIs to privilege escalation and data exposure, particularly when JWTs encode user roles or permissions without server-side verification.

Detection requires analyzing both the application logic and runtime behavior of authentication endpoints. Tools like middleBrick can help identify misconfigurations by scanning for missing signature checks or insecure token handling without requiring source code access.

Remediation involves ensuring that all JWTs are validated using strong cryptographic methods and that token parsing is tightly integrated with access control logic. Frameworks like Axum provide middleware that can enforce these checks consistently across routes.

In Axum, JWT cracking vulnerabilities often surface in authentication handlers that fail to validate token signatures or accept tokens without proper claims verification. For example, an endpoint might parse a JWT but skip signature verification, allowing attackers to forge tokens with elevated privileges. This can lead to BOLA (Broken Object Level Authorization) or IDOR vulnerabilities when token claims are used directly to authorize access to resources.

middleBrick detects such issues by probing API endpoints with crafted JWTs and analyzing responses for signs of unauthorized access. It checks whether tokens without valid signatures are accepted, whether token expiration is enforced, and whether role claims are properly mapped to access controls. The scanner also evaluates whether token claims are used in authorization decisions without additional server-side validation.

Remediation in Axum requires using secure token parsing libraries and enforcing strict validation rules. Developers should use the axum::Extension pattern to inject verified token claims into request context, ensuring that only authenticated and authorized requests proceed. Here is a correct implementation:

use axum::{routing::get, Router, extract::Extension, Json, http::StatusCode, response::IntoResponse};
use jsonwebtoken::{DecodingKey, Validation, jwt::Claims};

async fn protected_route(Extension(key): Extension>, Json claim) -> impl IntoResponse {
    // This should never happen if validation is enforced upstream
    if claim.expires_at.unwrap_or(0) < chrono::Utc::now().timestamp() {
        return (StatusCode::UNAUTHORIZED, "Token expired");
    }
    (StatusCode::OK, Json(claim))
}

async fn login_handler() -> &'static str {
    "login"
}

#[tokio::main]
async fn main() {
    let secret = vec![0x46, 0x61, 0x69, 0x6c, 0x65, 0x48, 0x65, 0x6c, 0x6c, 0x6f]; // Weak key example
    let app = Router::new()
        .route("/login", get(login_handler))
        .route("/protected", get(protected_route))
        .layer(Extension(secret)); // Inject key for validation

    axum::Server::bind(&"0.0.0.0:3000".parse().unwrap())
        .serve(app.into_make_service())
        .await;
}

This example shows proper token validation context, though the key must be strong and used only for verification. Detection tools like middleBrick can verify whether the application enforces these checks at runtime.

Additionally, Axum applications should avoid exposing token issuers or public keys that could aid attackers. middleBrick checks for such information leaks during unauthenticated scanning.