CVE-2022-36083

What it actually does

An attacker can supply a JWE with an extremely high p2c (PBES2 Count) value in the JOSE header when using PBKDF2-based key management algorithms. This triggers an unbounded number of PBKDF2 iterations during decryption of JWEs from untrusted sources when the library does not restrict accepted algorithms via keyManagementAlgorithms or equivalent, resulting in excessive CPU consumption.

Why it matters to the business

Services that accept and decrypt JWEs with symmetric secrets from external parties may experience resource exhaustion, leading to degraded performance or denial of service for legitimate users until the process completes or is terminated.

How an attack unfolds

An attacker crafts a JWE using one of the PBES2 algorithms and sets an abnormally large p2c value in the header. The victim application passes the JWE to the jose decryption API without limiting algorithms or inspecting p2c. The library performs the requested number of PBKDF2 iterations, consuming CPU time proportional to the chosen count and potentially stalling the process or thread.

How to fix it

Upgrade panva/jose to v1.28.2, v2.0.6, v3.20.4, or v4.9.2 (commit 179e2a7c22db97386a0495f2d1c31d59d939ed15) or later. After upgrading, the default maximum PBES2 iteration count is 10000; adjust via the maxPBES2Count option if needed. If immediate upgrade is impossible, restrict accepted algorithms using keyManagementAlgorithms to exclude PBES2 variants or inspect and cap the p2c header value before decryption.

How to confirm the fix worked

Confirm the installed jose version meets or exceeds the fixed releases listed above. Test by attempting decryption of a JWE with p2c exceeding 10000 and verify that the operation is rejected or capped rather than executing the full iteration count.

Typical attack path

1. Identify an endpoint that accepts and decrypts JWEs using symmetric keys without algorithm restrictions
2. Generate a JWE with a PBES2 algorithm and an extremely high p2c value
3. Send the crafted JWE to the target decryption routine
4. Observe sustained high CPU usage on the receiving system

How to detect it

Review application logs and process monitoring for unusually long-running or high-CPU decryption operations involving JWE payloads. Correlate with incoming requests containing JWE objects that include p2c values far above normal ranges. Examine source code and configuration for use of jose decrypt without algorithm restrictions.

What your security team should do

• Prioritize upgrade of panva/jose across all environments that decrypt untrusted JWEs
• Enable keyManagementAlgorithms restriction to disable PBES2 algorithms where not required
• Monitor for high-CPU decryption operations involving JWE handling
• Review and enforce input validation on JOSE headers before invoking decryption APIs