Executive brief
jose-node-cjs-runtime is a cryptographic library used to handle encrypted JSON Web Encryption (JWE) tokens. A timing side-channel vulnerability in AES-CBC decryption allows attackers to extract encrypted data without the decryption key by repeatedly querying the library and observing how long it takes to fail, potentially compromising sensitive data protected by these tokens.
Technical details
The vulnerability is a padding oracle attack resulting from an observable timing discrepancy in AES_CBC_HMAC_SHA2 decryption (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 algorithms). The library performed both HMAC tag verification and CBC decryption in sequence, but padding errors during decryption caused measurably different timing compared to HMAC verification failures. An unauthenticated network-accessible attacker can exploit this to decrypt JWE tokens without the key by issuing approximately 128*b oracle queries (where b is the ciphertext block size in bytes). The fix ensures HMAC verification executes before CBC decryption, eliminating the timing side-channel. Patches are available in version 3.11.4 and later.
Affected products
- panva jose-node-cjs-runtime <3.11.4
Timeline
- 2021-04-15: disclosed
- 2021-04-16: patched: Version 3.11.4 and later