Executive brief
JOSE is a popular cryptographic library used to create and verify cryptographic tokens (JWE/JWS). An attacker can craft a malicious token with an extremely high PBKDF2 iteration count parameter that forces the library to perform excessive CPU-intensive calculations when decrypting untrusted tokens, causing denial of service to the application. This affects only applications that decrypt tokens from untrusted sources without restricting the allowed encryption algorithms.
Technical details
The vulnerability is a resource exhaustion/algorithmic complexity attack (CWE-400, CWE-834) in JOSE's JWE decryption implementation. The PBKDF2-based key management algorithms (PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW) read an unbounded p2c (PBES2 Count) header parameter that specifies PBKDF2 iteration count. An attacker can set this to an extremely high value in a crafted JWE, forcing CPU-bound key derivation computations that consume unreasonable processing time. The attack requires network reachability and applies only to applications using symmetric JWE decryption APIs on untrusted tokens without restricting keyManagementAlgorithms. Patches in v1.28.2, v2.0.6, v3.20.4, and v4.9.2 limit the default maximum PBKDF2 count to 10000 iterations and introduce a configurable maxPBES2Count option.
Affected products
- panva jose 1.0.0 to 1.28.1, 2.0.0 to 2.0.5, 3.0.0 to 3.20.3, 4.0.0 to 4.9.1
- panva jose-browser-runtime 3.0.0 to 3.20.3, 4.0.0 to 4.9.1
- panva jose-node-cjs-runtime 3.0.0 to 3.20.3, 4.0.0 to 4.9.1
- panva jose-node-esm-runtime 3.0.0 to 3.20.3, 4.0.0 to 4.9.1
Timeline
- 2022-09-06: disclosed: Security advisory published
- 2022-09-16: patched: Patches released in v1.28.2, v2.0.6, v3.20.4, v4.9.2