CVE-2022-36083: JOSE JWE resource exhaustion via high PBKDF2 iteration count

CVE-2022-36083 · Severity: low · CVSS 3.1 · Published 2022-09-16

JOSE is a popular cryptographic library used to create and verify cryptographic tokens (JWE/JWS). An attacker can craft a malicious token with an extremely high PBKDF2 iteration count parameter that forces the library to perform excessive CPU-intensive calculations when decrypting untrusted tokens, causing denial of service to the application. This affects only applications that decrypt tokens from untrusted sources without restricting the allowed encryption algorithms.

Technologies: jose-node-cjs-runtime (npm), jose-node-esm-runtime (npm). Vendors: npm.

Quick answers

Is CVE-2022-36083 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-36083 being exploited in the wild.
How severe is CVE-2022-36083?
Low severity, with a CVSS score of 3.1, published 16 September 2022.
Which products and versions are affected?
jose (npm) SEMVER:introduced=1.0.0,fixed=1.28.2; jose-browser-runtime (npm) SEMVER:introduced=3.0.0,fixed=3.20.4; jose-node-cjs-runtime (npm) SEMVER:introduced=3.0.0,fixed=3.20.4; jose-node-esm-runtime (npm) SEMVER:introduced=3.0.0,fixed=3.20.4.
Is there a fix for CVE-2022-36083?
Yes. jose (npm): upgrade to 1.28.2 or later; jose-browser-runtime (npm): upgrade to 3.20.4 or later; jose-node-cjs-runtime (npm): upgrade to 3.20.4 or later; jose-node-esm-runtime (npm): upgrade to 3.20.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-36083 attacked?
It is attacked over the network.
Am I affected by CVE-2022-36083?
Check whether you run jose (npm), jose-browser-runtime (npm), jose-node-cjs-runtime (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • jose (npm): upgrade to 1.28.2 or later
    npm install jose@1.28.2
  • jose-browser-runtime (npm): upgrade to 3.20.4 or later
    npm install jose-browser-runtime@3.20.4
  • jose-node-cjs-runtime (npm): upgrade to 3.20.4 or later
    npm install jose-node-cjs-runtime@3.20.4
  • jose-node-esm-runtime (npm): upgrade to 3.20.4 or later
    npm install jose-node-esm-runtime@3.20.4

Technical details

The vulnerability is a resource exhaustion/algorithmic complexity attack (CWE-400, CWE-834) in JOSE's JWE decryption implementation. The PBKDF2-based key management algorithms (PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW) read an unbounded p2c (PBES2 Count) header parameter that specifies PBKDF2 iteration count. An attacker can set this to an extremely high value in a crafted JWE, forcing CPU-bound key derivation computations that consume unreasonable processing time. The attack requires network reachability and applies only to applications using symmetric JWE decryption APIs on untrusted tokens without restricting keyManagementAlgorithms. Patches in v1.28.2, v2.0.6, v3.20.4, and v4.9.2 limit the default maximum PBKDF2 count to 10000 iterations and introduce a configurable maxPBES2Count option.

Affected products

  • panva jose 1.0.0 to 1.28.1, 2.0.0 to 2.0.5, 3.0.0 to 3.20.3, 4.0.0 to 4.9.1
  • panva jose-browser-runtime 3.0.0 to 3.20.3, 4.0.0 to 4.9.1
  • panva jose-node-cjs-runtime 3.0.0 to 3.20.3, 4.0.0 to 4.9.1
  • panva jose-node-esm-runtime 3.0.0 to 3.20.3, 4.0.0 to 4.9.1

Identifiers

  • CVE-2022-36083
  • GHSA-jv3g-j58f-9mq9

Timeline

  • 2022-09-06: disclosed: Security advisory published
  • 2022-09-16: patched: Patches released in v1.28.2, v2.0.6, v3.20.4, v4.9.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.