Timing Attack Affecting io.jsonwebtoken:jjwt package, versions [,0.6.0)

Affected versions of this package are vulnerable to Timing Attack in the isValid(byte[], byte[]) methods of MacValidator and RsaSignatureValidator, both of which compute the expected signature locally and compare it to the supplied one with java.util.Arrays.equals, which returns at the first differing byte so the elapsed time tracks the length of the matching prefix. An attacker can recover a valid signature byte by byte without the key, and then forge tokens and impersonate any user, by submitting tokens repeatedly to the same endpoint and measuring response latency, needing at most 256 probes per byte position and so at most 8,192 requests for a 32-byte HS256 MAC. This needs timing resolution fine enough to separate one byte of comparison work, which is practical mainly from a co-located or low latency position, and the RSA path is reached only when an RSAPrivateKey is configured as the validator key, so the sign and compare branch runs instead of the JCA Signature.verify path.

• GitHub Commit
• Vulnerability Advisory