Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime

Vulnerability

In jose-browser-runtime versions prior to 3.11.4, the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption routine always executed both HMAC tag verification and CBC decryption. If either failed, JWEDecryptionFailed was thrown; however, the timing of the padding error during CBC decryption could differ observably, creating a padding oracle [1][3].

Exploitation

An attacker with network access to a system that decrypts JWE ciphertexts using the vulnerable algorithm can observe timing differences in decryption responses. By crafting ciphertexts and measuring response times, the attacker can issue on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block) to infer plaintext content without possessing the decryption key [1][3].

Impact

Successful exploitation allows the attacker to recover plaintext data from encrypted messages. This compromises confidentiality of data encrypted using the affected algorithms. No authentication or user interaction is required beyond the ability to send ciphertexts to the decryption endpoint [1].

Mitigation

A patch was released in version 3.11.4 that ensures the HMAC tag is verified before performing CBC decryption, preventing the timing side channel. Users should upgrade to ^3.11.4 or later [1][3]. No workarounds are documented; upgrading is the recommended action.