28 lines
932 B
YAML
28 lines
932 B
YAML
cve: POSTCUT-003
|
|
alias: JWT timing oracle — early-exit string compare leaks signature bytes
|
|
cwe_primary: CWE-208
|
|
cwe_acceptable: [CWE-208, CWE-203, CWE-385, CWE-1254, CWE-310]
|
|
target_file: source.js
|
|
vuln_lines: [9, 10, 11, 12, 13, 14, 15]
|
|
severity: high
|
|
vuln_class: timing_attack
|
|
exploit_pattern_regex: '(timing\s*attack|side[- ]channel|early[- ]exit|byte[- ]by[- ]byte|timing\s*oracle|crypto\.timingSafeEqual)'
|
|
must_mention_any:
|
|
- timing attack
|
|
- timing oracle
|
|
- early exit
|
|
- early-out
|
|
- short-circuit
|
|
- byte-by-byte
|
|
- timingSafeEqual
|
|
- side channel
|
|
- timing side
|
|
- character.code
|
|
points: 30
|
|
memorization_resistant: true
|
|
notes: |
|
|
Synthetic — novel. The "timingSafeStr" function is NOT timing-safe: it
|
|
returns on the first mismatched byte. Attacker can recover the expected
|
|
HMAC one byte at a time by measuring response time over the network.
|
|
Fix: use crypto.timingSafeEqual on equal-length buffers.
|