CVE-2022-36083 (TypeScript, published 2022-09-07T22:15Z)
Description: value: JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted source: an adversary can intentionally pick an extremely high PBES2 Count value, that will initiate a CPU-bound computation that may take an unreasonable amount of time to finish. Under certain conditions, it is possible to have the user's environment consume unreasonable amount of CPU time. The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (`alg` Header Parameter) using the `keyManagementAlgorithms` (or `algorithms` in v1.x) decryption option or through other means. The `v1.28.2`, `v2.0.6`, `v3.20.4`, and `v4.9.2` releases limit the maximum PBKDF2 iteration count to `10000` by default. It is possible to adjust this limit with a newly introduced `maxPBES2Count` decryption option. If users are unable to upgrade their required library version, they have two options depending on whether they expect to receive JWEs using any of the three PBKDF2-based JWE key management algorithms. They can use the `keyManagementAlgorithms` decryption option to disable accepting PBKDF2 altogether, or they can inspect the JOSE Header prior to using the decryption API and limit the PBKDF2 iteration count (`p2c` Header Parameter).
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/panva/jose
Files changed:
src/jwe/flattened/decrypt.ts
src/lib/decrypt_key_management.ts
src/types.d.ts
test/jwe/flattened.decrypt.test.mjs
Commit message: fix: limit default PBES2 alg's computational expense

Also adds an option to opt-in to higher computation expense.


Vulnerable code:
    cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader)
    if (err instanceof TypeError) {
import type { JWEHeaderParameters, KeyLike, JWK } from '../types.d'
import { root } from '../dist.mjs'
      message: 'decryption operation failed',
      code: 'ERR_JWE_DECRYPTION_FAILED',

Fixed code:
    cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
    if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
import type { DecryptOptions, JWEHeaderParameters, KeyLike, JWK } from '../types.d'
  options?: DecryptOptions,
      const p2cLimit = options?.maxPBES2Count || 10_000

      if (joseHeader.p2c > p2cLimit)
        throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`)


  /**
   * (PBES2 Key Management Algorithms only) Maximum allowed "p2c" (PBES2 Count) Header Parameter
   * value. The PBKDF2 iteration count defines the algorithm's computational expense. By default
   * this value is set to 10000.
   */
  maxPBES2Count?: number
import { root, conditional } from '../dist.mjs'
      message: 'Encountered unexpected JWE Encrypted Key',
      code: 'ERR_JWE_INVALID',

conditional({ electron: 0 })('decrypt PBES2 p2c limit', async (t) => {
  const jwe = await new FlattenedEncrypt(new Uint8Array(0))
    .setProtectedHeader({ alg: 'PBES2-HS256+A128KW', enc: 'A128CBC-HS256' })
    .setKeyManagementParameters({ p2c: 2049 })
    .encrypt(new Uint8Array(32))

  await t.throwsAsync(flattenedDecrypt(jwe, new Uint8Array(32), { maxPBES2Count: 2048 }), {
    message: 'JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds',
    code: 'ERR_JWE_INVALID',
  })
})