Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

Vulnerability

In jose-node-cjs-runtime versions prior to 3.11.4, the AES_CBC_HMAC_SHA2 algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) performed HMAC tag verification and CBC decryption sequentially without early termination. If either step failed, a generic JWEDecryptionFailed error was thrown, but the timing of the decryption step varied depending on whether a padding error occurred. This creates a padding oracle vulnerability [1][3].

Exploitation

An attacker can send crafted ciphertexts to a decryption oracle and measure the response time. By observing differences in timing when a padding error occurs versus when it does not, the attacker can issue on average 128 * b chosen ciphertext queries (where b is the number of bytes in the ciphertext block) to decrypt the data without knowledge of the decryption key [1][3]. No authentication or special network position is required beyond access to the decryption endpoint.

Impact

Successful exploitation allows the attacker to decrypt arbitrary ciphertexts protected by the affected algorithms, leading to full disclosure of encrypted data. The confidentiality of JWEs (JSON Web Encryption) using AES-CBC-HMAC-SHA2 is compromised [1][3]. The attacker does not gain the ability to encrypt or forge messages, only to decrypt existing ones.

Mitigation

The vulnerability is fixed in jose-node-cjs-runtime version 3.11.4 and later. Users should upgrade to ^3.11.4 immediately [1][3]. No workaround is available for earlier versions. The advisory credits Morgan Brown of Microsoft for discovery [3].