Improper Verification of Cryptographic Signature (CWE-347)

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Cryptographic signatures are used to verify the authenticity and integrity of data. When signature verification is missing or incorrectly implemented, attackers can forge or tamper with data.

보급률

높음

자주 악용됨

영향

치명적

1개의 치명적 심각도 규칙

예방

문서화됨

4개의 수정 예시

2 예방

이 취약점을 수정하는 방법

4개의 Shoulder 탐지 규칙을 기반으로 한 Improper Signature Verification 예방 전략.

🐍 Python 모두 보기 Python 자세히 →

FastAPI JWT Security Issues HIGH

Load JWT secret from environment and explicitly specify allowed algorithms

+11 -6 python

- from jose import jwt
- 
- SECRET = "my-secret-key"
- 
- def decode_token(token: str):
-     return jwt.decode(token, SECRET)
+ from pydantic_settings import BaseSettings
+ from jose import jwt
+ 
+ class Settings(BaseSettings):
+     SECRET_KEY: str
+     ALGORITHM: str = "HS256"
+ 
+ settings = Settings()
+ 
+ def decode_token(token: str):
+     return jwt.decode(token, settings.SECRET_KEY, algorithms=[settings.ALGORITHM])

JWT Algorithm Confusion Attack CRITICAL

Always specify allowed algorithms explicitly when decoding JWT tokens

+13 -7 python

  import jwt
- from flask import request
- 
- @app.route('/api/user')
- def get_user():
-     token = request.headers.get('Authorization')
-     payload = jwt.decode(token, SECRET_KEY, verify=False)
-     return {'user': payload['user_id']}
+ import os
+ from flask import request
+ 
+ SECRET_KEY = os.environ['JWT_SECRET']
+ 
+ @app.route('/api/user')
+ def get_user():
+     token = request.headers.get('Authorization')
+     try:
+         payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256'])
+         return {'user': payload['user_id']}
+     except jwt.InvalidTokenError:
+         return {'error': 'Invalid token'}, 401

🐹 Go 모두 보기 Go 자세히 →

JWT Security Vulnerabilities HIGH

Validate JWT algorithm explicitly, use strong secrets, and set expiration

+4 -1 go

  func parseToken(tokenString string) (*jwt.Token, error) {
      return jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
-         return []byte("secret"), nil
+         if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+             return nil, fmt.Errorf("unexpected method: %v", token.Header["alg"])
+         }
+         return []byte(os.Getenv("JWT_SECRET")), nil
      })
  }

🟨 JavaScript 모두 보기 JavaScript 자세히 →

JWT Decode Without Verification HIGH

Use jwt.verify() instead of jwt.decode() to validate token signatures

+3 -1 javascript

- const decoded = jwt.decode(token);
+ const decoded = jwt.verify(token, process.env.JWT_SECRET, {
+   algorithms: ['RS256']
+ });
  req.user = decoded;

핵심 실천 사항

Use of jwt

3 탐지

코드에서 취약점 찾기

Shoulder를 사용하여 코드에서 Improper Verification of Cryptographic Signature 패턴을 스캔하세요. 4 규칙.

터미널

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=347

# Or scan entire project
npx @shoulderdev/cli trust .

탐지 규칙 (4)

🐍 Python 2 rules

FastAPI JWT Security Issues HIGH

Detects JWT security issues in FastAPI applications including: - Weak or hardcoded secrets - Missing algorithm verification - Insufficient token validation - Insecure token storage patterns

JWT Algorithm Confusion Attack CRITICAL

Detects JWT tokens decoded without algorithm verification or accepting the 'none' algorithm, allowing token forgery.

🐹 Go 1 rules

JWT Security Vulnerabilities HIGH

JWT allows "none" algorithm, uses weak secret, or lacks expiration.

🟨 Javascript 1 rules

JWT Decode Without Verification HIGH

Detects use of jwt.decode() without proper verification, leading to authentication bypass. jwt.decode() decodes a JWT token WITHOUT verifying its signature. This means an attacker can create a token with any payload they want, and the application will trust it. Common mistakes: - Using jwt.decode() instead of jwt.verify() - Decoding token for inspection then trusting the payload - Using decoded payload for authorization decisions The decoded payload should NEVER be trusted for security decisi

🔷 Typescript 1 rules

JWT Decode Without Verification HIGH

4 경고 신호

코드 리뷰에서 주의할 점

이 패턴은 잠재적인 Improper Verification of Cryptographic Signature 취약점을 나타냅니다. 코드 리뷰와 보안 감사 중에 찾아보세요.

🟠

JWT implementation has security vulnerabilities fastapi-jwt-security

🟠

JWT security issues in FastAPI applications including: - Weak or hardcoded secrets - Missing algorit fastapi-jwt-security

🟠

use of jwt javascript-jwt-decode-without-verify

🔴

JWT tokens decoded without algorithm verification or accepting the 'none' algorithm, allowing token python-jwt-algorithm-confusion

🔍

코드베이스를 스캔하세요: Improper Verification of Cryptographic Signature

Shoulder CLI는 전체 코드베이스에서 취약한 패턴을 찾아냅니다.

npx shoulder trust 모든 규칙 보기