Executive brief
The jose-node-esm-runtime library is used to handle JSON Web Encryption (JWE) and cryptographic operations in Node.js applications. A timing side-channel vulnerability in its AES-CBC-HMAC decryption allows attackers to decrypt encrypted messages without the key by exploiting observable differences in how long decryption takes. This could lead to unauthorized disclosure of encrypted data handled by applications using vulnerable versions of the library.
Technical details
The vulnerability is a timing-based padding oracle in the AES_CBC_HMAC_SHA2 decryption algorithm (variants A128CBC-HS256, A192CBC-HS384, A256CBC-HS512). The root cause is that both HMAC tag verification and CBC decryption are executed regardless of which fails, and padding validation errors occur at a different point in execution than HMAC failures, creating a measurable timing difference. This allows an attacker without network or authentication prerequisites to recover plaintext by issuing repeated decryption requests and measuring response times to identify which padding values are valid. The fix (released in version ≥3.11.4) reorders operations to verify the HMAC tag before performing CBC decryption, eliminating the observable timing discrepancy. The patch is available and users should upgrade immediately.
Affected products
- panva jose-node-esm-runtime < 3.11.4
Timeline
- 2021-04-15: disclosed
- 2021-04-16: patched: version 3.11.4 released with fix