Audience Array Type Confusion (CVE-2020-26160)

According to RFC 7519, the aud (Audience) claim can be either a single string or an array of strings. In vulnerable versions of jwt-go, extracting the audience claim using a string type assertion (claims["aud"].(string)) silently failed whenever an array was provided, causing the audience to evaluate to an empty string ("").

This endpoint simulates an Admin Console. The service checks the signature using an internal identity provider key (you cannot forge new tokens). Its authorization logic applies these rules:

Tokens intended for specific clients (like public_api) are strictly denied access.
Tokens with no audience specified ("") are grandfathered in as legacy internal admin tokens.

Available Signed Tokens

Both tokens below are legitimately signed by the identity provider:

1. Bob's Token (Single Audience):
Payload: {"user": "bob", "aud": "public_api"}

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJwdWJsaWNfYXBpIiwidXNlciI6ImJvYiJ9.F_ZxOhIAWGhUtYmgaTKBTo1Pyd1C41NfbktrOzVys7s

2. Alice's Token (Multi-Audience Array):
Payload: {"user": "alice", "aud": ["billing_service", "reports_service"]}

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsiYmlsbGluZ19zZXJ2aWNlIiwicmVwb3J0c19zZXJ2aWNlIl0sInVzZXIiOiJhbGljZSJ9.Zsi_jpo4LBIFUM8uxArFnoNdFse_MsskIWh7raJw7mQ

Submit to Admin Console

Back to home

Lab created by Robin Wood - DigiNinja