Open P3ngu1nW opened 6 months ago
Hello @P3ngu1nW
I'm fairly new to this field, so please bear with me. I've been trying to understand this issue and have read up on the JWT bomb attack.
To tackle it, do we simply need to cap the token size at 250K? If so, I've made the necessary changes in the decrypt function of my forked repository. Could you please review it and let me know if there's anything else required?
Thank You, Prince
Hi! I think that's reasonable. Thank you!
Hello,
Thanks for the confirmation!. Created PR #345
Following up on this.
I've created a more comprehensive pull request which includes tests: https://github.com/mpdavis/python-jose/pull/352
This is CVE-2024-33664
@P3ngu1nW or @alistairwatts, thanks for reporting this CVE. It seems to be specific to tokens with compression. If I know that for my application, all valid tokens are uncompressed, is there a way how I could disable compression support in python-jose?
I also don't quite understand which functions of the library are affected:
jwt.decode()
?jwe.decrypt()
.jwt.decode()
affected or not?Your description has a section "Who is impacted?", which is a good idea, but unfortunately does not contain enough information for non-crypto-experts to determine if their library usage is safe regarding this CVE or not.
@heidemn-faro, if your application is not supporting encrypted tokens, then it doesn't look like the vulnerability affects you. You should be fine if you're not using jose.jwe
, but please check this for yourself. If you wanted to be sure that this vulnerability doesn't affect your application then you could consider removing jwe.py
from the jose
package and checking your application is unaffected.
If jose.jwe
is used then the following will monkey-patch the library and remove support for the DEF
compression.
import jose.constants
jose.constants.ZIPS.SUPPORTED.discard('DEF')
There are patch files that need to be added into this repo: https://build.opensuse.org/projects/openSUSE:Factory/packages/python-python-jose/files/CVE-2024-33663.patch and https://build.opensuse.org/projects/openSUSE:Factory/packages/python-python-jose/files/CVE-2024-33664.patch
@P3ngu1nW please help me understand why you've closed the ticket? I don't see any related commit on the master branch.
@P3ngu1nW please help me understand why you've closed the ticket? I don't see any related commit on the master branch.
I saw @gitjkesslergs mentioned a fix for this
JWT bomb Attack in decode function
0x01 Affected version
vendor: https://github.com/mpdavis/python-jose
version: 3.3.0
0x02 What kind of vulnerability is it? Who is impacted?
This vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
0x03 Vulnerability details
The Proof of Concept (PoC) below demonstrates how this vulnerability can lead to a DoS attack:
This vulnerability is demonstrated by comparing the processing times of a compressed token to an uncompressed token of the same length. The compressed token's processing time is significantly higher, showcasing the vulnerability's potential impact.
0x04 Mitigation
To mitigate this vulnerability, it is recommended to limit the maximum token length to 250K. This approach has also been adopted by the JWT library System.IdentityModel.Tokens.Jwt used in Microsoft Azure [1], effectively preventing attackers from exploiting this vulnerability with high compression ratio tokens.
0x05 References
[1] CVE-2024-21319