GHSA-RM8V-MXJ3-5RMQ
Vulnerability from github – Published: 2023-06-14 17:24 – Updated: 2023-06-14 17:24Summary
Decrypting AES-CBC encrypted JWE has Potential Padding Oracle Attack Vulnerability.
Details
On v2.0.10, decrypting AES-CBC encrypted JWE may return an error "failed to generate plaintext from decrypted blocks: invalid padding":
https://github.com/lestrrat-go/jwx/blob/8840ffd4afc5839f591ff0e9ba9034af52b1643e/jwe/internal/aescbc/aescbc.go#L210-L213
Reporting padding error causes Padding Oracle Attack Vulnerability. RFC 7516 JSON Web Encryption (JWE) says that we MUST NOT do this.
11.5. Timing Attacks To mitigate the attacks described in RFC 3218 [RFC3218], the recipient MUST NOT distinguish between format, padding, and length errors of encrypted keys. It is strongly recommended, in the event of receiving an improperly formatted key, that the recipient substitute a randomly generated CEK and proceed to the next step, to mitigate timing attacks.
In addition, the time to remove padding depends on the length of the padding. It may leak the length of the padding by Timing Attacks.
https://github.com/lestrrat-go/jwx/blob/796b2a9101cf7e7cb66455e4d97f3c158ee10904/jwe/internal/aescbc/aescbc.go#L33-L66
To mitigate Timing Attacks, it MUST be done in constant time.
Impact
The authentication tag is verified, so it is not an immediate attack.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.10"
},
"package": {
"ecosystem": "Go",
"name": "github.com/lestrrat-go/jwx/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.2.25"
},
"package": {
"ecosystem": "Go",
"name": "github.com/lestrrat-go/jwx"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.26"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [],
"github_reviewed": true,
"github_reviewed_at": "2023-06-14T17:24:36Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nDecrypting AES-CBC encrypted JWE has Potential Padding Oracle Attack Vulnerability.\n\n### Details\n\nOn [v2.0.10](https://github.com/lestrrat-go/jwx/releases/tag/v2.0.10), decrypting AES-CBC encrypted JWE may return an error \"failed to generate plaintext from decrypted blocks: invalid padding\":\n\nhttps://github.com/lestrrat-go/jwx/blob/8840ffd4afc5839f591ff0e9ba9034af52b1643e/jwe/internal/aescbc/aescbc.go#L210-L213\n\nReporting padding error causes [Padding Oracle Attack](https://en.wikipedia.org/wiki/Padding_oracle_attack) Vulnerability.\nRFC 7516 JSON Web Encryption (JWE) says that we **MUST NOT** do this.\n\n\u003e 11.5. Timing Attacks\n\u003e To mitigate the attacks described in RFC 3218 [RFC3218], the\n\u003e recipient MUST NOT distinguish between format, padding, and length\n\u003e errors of encrypted keys. It is strongly recommended, in the event\n\u003e of receiving an improperly formatted key, that the recipient\n\u003e substitute a randomly generated CEK and proceed to the next step, to\n\u003e mitigate timing attacks.\n\nIn addition, the time to remove padding depends on the length of the padding.\nIt may leak the length of the padding by Timing Attacks.\n\nhttps://github.com/lestrrat-go/jwx/blob/796b2a9101cf7e7cb66455e4d97f3c158ee10904/jwe/internal/aescbc/aescbc.go#L33-L66\n\nTo mitigate Timing Attacks, it MUST be done in constant time.\n\n### Impact\n\nThe authentication tag is verified, so it is not an immediate attack.\n",
"id": "GHSA-rm8v-mxj3-5rmq",
"modified": "2023-06-14T17:24:36Z",
"published": "2023-06-14T17:24:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-rm8v-mxj3-5rmq"
},
{
"type": "WEB",
"url": "https://github.com/lestrrat-go/jwx/commit/6c41e3822485fc7e11dd70b4b0524b075d66b103"
},
{
"type": "WEB",
"url": "https://github.com/lestrrat-go/jwx/commit/d9ddbc8e5009cfdd8c28413390b67afa7f576dd6"
},
{
"type": "PACKAGE",
"url": "https://github.com/lestrrat-go/jwx"
},
{
"type": "WEB",
"url": "https://github.com/lestrrat-go/jwx/blob/796b2a9101cf7e7cb66455e4d97f3c158ee10904/jwe/internal/aescbc/aescbc.go#L33-L66"
},
{
"type": "WEB",
"url": "https://github.com/lestrrat-go/jwx/blob/8840ffd4afc5839f591ff0e9ba9034af52b1643e/jwe/internal/aescbc/aescbc.go#L210-L213"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "github.com/lestrrat-go/jwx vulnerable to Potential Padding Oracle Attack"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.