Description
The scanner detected a missing validation of the 'jku' parameter in a JSON Web Token's header. This parameter specifies the location of the JSON web key set (JWKS) used to verify the token's signature. Without proper validation, an attacker can supply a JWKS, potentially allowing the creation of forged JWTs with arbitrary payloads. Attackers might be able to tamper with the values inside the JWT token payload and escalate privileges, impersonate users or trigger unintended application states that were meant to be prevented by the use of a tamper-proof token solution. Additionally they may be able to trigger a blind SSRF attack.
Remediation
In order to fix this vulnerability, you need to implement a whitelist of URLs that are allowed to host a JWKS file, specified in the 'jku' header parameter. To make sure it is resilient to validation bypasses, please make sure to validate the full URL and path and disable HTTP redirection for the HTTP library responsible for the token retrieval.