JWT Role / Privilege Claim Tampering

jwt-role-tampering is a critical severity check in the web category, written in python. Its source is templates/web/jwt/jwt-role-tampering.py in cert-x-gen-templates.

What it checks

Tests whether the server validates JWT claim integrity by replaying tokens with elevated role/privilege claims (admin, superuser, role=admin, isAdmin=true) without re-signing. Also tests claim injection via unverified kid/jku header parameters.

Header

Field	Value
Id	jwt-role-tampering
Severity	critical
Language	python
Category	web
Author	BugB Security Team
Template version	1.0.0
Confidence	80
CVSS	9.3
Weakness	CWE-285
Tags	jwt, role-tampering, privilege-escalation, authentication, owasp-a01, owasp-a02, claim-injection
Target kind	not recorded
Oracle	not recorded

The file declares @auto_probe, @batch_group, @context_vars, @hypothesis_tags, @vuln_class as well. Those are not tabled above; read the source for what they carry.

References

Declared in the header. cxg parses @references and then discards it, and nothing at scan time reads it, so this is the only place the links a template cites are surfaced.

• https://portswigger.net/web-security/jwt
• https://cwe.mitre.org/data/definitions/285.html
• https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/

Run it

To see what the copy on your machine says about itself, and to confirm it is installed at all:

cxg template info jwt-role-tampering

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Related

• Template catalog is the whole corpus.
• web is the rest of this category.
• Templates by weakness class groups checks by the defect they look for.
• Contribute a template is the route from a check you needed and could not find to a merged one.