Merge pull request #11 from cerberauth/jwt-weak-rsa-key

feat: add jwt weak rsa key challenge

challenges/jwt-weak-rsa-key/.gitignore

@@ -0,0 +1,14 @@
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+jwt-weak-rsa-key

challenges/jwt-weak-rsa-key/Dockerfile

@@ -0,0 +1,23 @@
+FROM golang:1.21 AS builder
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . ./
+
+RUN CGO_ENABLED=0 GOOS=linux GO111MODULE=on go build -o /jwt-weak-rsa-key .
+
+FROM gcr.io/distroless/static-debian11:nonroot AS runner
+
+WORKDIR /
+
+COPY --from=builder --chown=nonroot:nonroot /jwt-weak-rsa-key /usr/bin/jwt-weak-rsa-key
+
+EXPOSE 8080
+
+USER nonroot:nonroot
+
+ENTRYPOINT ["jwt-weak-rsa-key", "serve"]
+CMD ["jwt-weak-rsa-key"]

challenges/jwt-weak-rsa-key/cmd/jwt/root.go

@@ -0,0 +1,52 @@
+package jwt
+
+import (
+	"fmt"
+	"log"
+	"os"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/spf13/cobra"
+)
+
+func GenerateRS512JWT(sub string) (string, error) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+
+	privateKeyBytes, err := os.ReadFile(cwd + string(os.PathSeparator) + "keys/private_key.pem")
+	if err != nil {
+		return "", err
+	}
+
+	key, err := jwt.ParseRSAPrivateKeyFromPEM(privateKeyBytes)
+	if err != nil {
+		return "", err
+	}
+
+	tokenString, err := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{
+		"sub": sub,
+	}).SignedString(key)
+	if err != nil {
+		return "", err
+	}
+
+	return tokenString, nil
+}
+
+func NewJwtCmd() (jwtCmd *cobra.Command) {
+	jwtCmd = &cobra.Command{
+		Use: "jwt",
+		Run: func(cmd *cobra.Command, args []string) {
+			tokenString, err := GenerateRS512JWT("abc123")
+			if err != nil {
+				log.Fatal(err)
+			}
+
+			fmt.Printf("token: %s", tokenString)
+		},
+	}
+
+	return jwtCmd
+}

challenges/jwt-weak-rsa-key/cmd/root.go

@@ -0,0 +1,29 @@
+package cmd
+
+import (
+	"os"
+
+	"github.com/cerberauth/api-vulns-challenges/challenges/jwt-weak-rsa-key/cmd/jwt"
+	"github.com/cerberauth/api-vulns-challenges/challenges/jwt-weak-rsa-key/cmd/serve"
+
+	"github.com/spf13/cobra"
+)
+
+func NewRootCmd() (cmd *cobra.Command) {
+	var rootCmd = &cobra.Command{}
+
+	rootCmd.AddCommand(serve.NewServeCmd())
+	rootCmd.AddCommand(jwt.NewJwtCmd())
+
+	return rootCmd
+}
+
+// Execute adds all child commands to the root command and sets flags appropriately.
+// This is called by main.main(). It only needs to happen once to the RootCmd.
+func Execute() {
+	c := NewRootCmd()
+
+	if err := c.Execute(); err != nil {
+		os.Exit(1)
+	}
+}

challenges/jwt-weak-rsa-key/cmd/serve/root.go

@@ -0,0 +1,18 @@
+package serve
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/cerberauth/api-vulns-challenges/challenges/jwt-weak-rsa-key/serve"
+)
+
+func NewServeCmd() (serveCmd *cobra.Command) {
+	serveCmd = &cobra.Command{
+		Use: "serve",
+		Run: func(cmd *cobra.Command, args []string) {
+			serve.RunServer()
+		},
+	}
+
+	return serveCmd
+}

challenges/jwt-weak-rsa-key/go.mod

@@ -0,0 +1,13 @@
+module github.com/cerberauth/api-vulns-challenges/challenges/jwt-weak-rsa-key
+
+go 1.20
+
+require (
+	github.com/golang-jwt/jwt/v5 v5.0.0
+	github.com/spf13/cobra v1.7.0
+)
+
+require (
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+)

challenges/jwt-weak-rsa-key/go.sum

@@ -0,0 +1,12 @@
+github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/golang-jwt/jwt/v5 v5.0.0 h1:1n1XNM9hk7O9mnQoNBGolZvzebBQ7p93ULHRc28XJUE=
+github.com/golang-jwt/jwt/v5 v5.0.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
+github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

challenges/jwt-weak-rsa-key/jwt.hash

@@ -0,0 +1 @@
+eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.t-IDcSemACt8x4iTMCda8Yhe3iZaWbvV5XKSTbuAn0M

challenges/jwt-weak-rsa-key/keys/private_key.pem

@@ -0,0 +1,10 @@
+-----BEGIN PRIVATE KEY-----
+MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEA0SrRqljWh9BACyoN
+bAoVK0zoQTy1dn2HWugAd1RrsViV+BmUA2bIfiVuJml61UWGg0eKaGIffnTqkU8E
+Hde9AQIDAQABAkEAvNPHC92/bkRWTL3d+BbyHXEEi0BfIWUZeLvRD+kqf6IzEU9r
+O5xKVtY1B48Rzq8OZxxmvs8/4WxUI9+dlM0fMQIhAPMSaUpBnABrdTaXpUFIRdAi
+xO/rpSZf0DwjUwI/a+ZTAiEA3ErF2e9zxETg8Go2QphdywQOlMMEQJ2LF/jLUGjw
+/NsCIQDdlRgUkDDFFTB5/s2v8FFsBnYe/GLF06xBVjZSozwabwIgebNdZq8g97dN
+xcQHwfbHKldNbuXmPYRLyayLNhsjt60CICuIXc2yaEeI50aByEevpfQOfcHh57ch
+Ow8psJv1hEcU
+-----END PRIVATE KEY-----

challenges/jwt-weak-rsa-key/keys/public_key.pem

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANEq0apY1ofQQAsqDWwKFStM6EE8tXZ9
+h1roAHdUa7FYlfgZlANmyH4lbiZpetVFhoNHimhiH3506pFPBB3XvQECAwEAAQ==
+-----END PUBLIC KEY-----

challenges/jwt-weak-rsa-key/main.go

@@ -0,0 +1,7 @@
+package main
+
+import "github.com/cerberauth/api-vulns-challenges/challenges/jwt-weak-rsa-key/cmd"
+
+func main() {
+	cmd.Execute()
+}

challenges/jwt-weak-rsa-key/serve/server.go

@@ -0,0 +1,38 @@
+package serve
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"strings"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+func RunServer() {
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		authorizationHeader := r.Header.Get("authorization")
+		if authorizationHeader == "" {
+			w.WriteHeader(401)
+			return
+		}
+
+		parts := strings.Split(authorizationHeader, "Bearer")
+		if len(parts) != 2 {
+			w.WriteHeader(401)
+			return
+		}
+
+		tokenString := strings.TrimSpace(parts[1])
+		token, _, err := new(jwt.Parser).ParseUnverified(tokenString, jwt.MapClaims{})
+
+		if token != nil && err == nil {
+			w.WriteHeader(204)
+		} else {
+			fmt.Println(err)
+			w.WriteHeader(401)
+		}
+	})
+
+	log.Fatal(http.ListenAndServe(":8080", nil))
+}