Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime

Vulnerability

In jose-node-esm-runtime versions prior to 3.11.4, the AES_CBC_HMAC_SHA2 algorithm decryption (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) executed both HMAC tag verification and CBC decryption regardless of errors. If either failed, JWEDecryptionFailed was thrown. However, a timing discrepancy occurs when a padding error arises during CBC decryption, enabling a padding oracle attack. This affects all versions before 3.11.4. [1][3]

Exploitation

An attacker with network access to observe timing can send crafted ciphertexts to the decryption oracle. By measuring response times, the attacker can determine padding validity. On average, 128*b calls are needed (b = ciphertext block bytes) to decrypt the entire ciphertext without knowing the key. [1][3]

Impact

Successful exploitation allows an attacker to decrypt arbitrary ciphertexts encrypted with the affected algorithm, leading to information disclosure of sensitive data. No authentication is required for the oracle. [1][3]

Mitigation

The fix ensures HMAC tag verification occurs before CBC decryption, eliminating the timing discrepancy. Fixed in version 3.11.4 and later. Users should upgrade to ^3.11.4. No workaround available. [1][3]