Description
The scanner detected a missing validation of the 'x5u' parameter in the header of a JSON Web Token (JWT). This parameter specifies the location of the X.509 certificate chain used to verify the token's signature. Without proper validation, an attacker can supply a malicious certificate, potentially allowing the creation of forged JWTs with arbitrary payloads. Attackers might be able to tamper with the values inside the JWT token payload and escalate privileges, impersonate users or trigger unintended application states that were meant to be prevented by the use of a tamper-proof token solution. Additionally they may be able to trigger a blind SSRF attack.
Remediation
In order to fix this vulnerability, you need to implement a whitelist of URLs that are allowed to host a x509 cert file, specified in the 'x5u' header parameter. To make sure it is resilient to validation bypasses, please make sure to validate the full URL and path and disable HTTP redirection for the HTTP library responsible for the token retrieval.