Padding Oracle Attack due to Observable Timing Discrepancy in jose

Vulnerability

The jose npm library's implementation of the AES_CBC_HMAC_SHA2 algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) performs both HMAC tag verification and CBC decryption before throwing JWEDecryptionFailed if either fails [1][2]. This creates a timing side-channel: a padding error during CBC decryption produces a measurably different response time, effectively creating a padding oracle [1][2]. All versions prior to the patches are affected: v1.x before 1.28.1, v2.x before 2.0.5, and v3.x before 3.11.4 [1][2].

Exploitation

An attacker with network access to a system using the vulnerable library can send chosen ciphertexts and observe the response timing [1][2]. By issuing on average 128*b calls (where b is the ciphertext block size in bytes) to the padding oracle, the attacker can decrypt arbitrary ciphertext blocks without knowledge of the decryption key [1][2]. No authentication or special privileges are required beyond the ability to interact with the decryption endpoint [1][2].

Impact

Successful exploitation allows an attacker to decrypt data that was encrypted using the affected AES_CBC_HMAC_SHA2 algorithms, leading to full disclosure of the encrypted content [1][2]. The attacker gains no code execution or privilege escalation, but the confidentiality of the encrypted data is completely compromised [1][2].

Mitigation

The vulnerability is fixed in versions ^1.28.1, ^2.0.5, and >=3.11.4 [1][2]. Users should upgrade their dependencies accordingly [1][2]. The patch ensures that HMAC tag verification is performed before CBC decryption, eliminating the timing oracle [2]. No workarounds are available for unpatched versions [1][2]. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.