CVE-2024-33664

Denial of service via high compression ratio in JSON Web Encryption tokens.

• CVSS 5.3
• CWE-400
• Resource Management
• Remote

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.

CVE

CVE-2024-33664

CWE

CWE-400

CVSS base score

5.3

Published

2024-04-26

OWASP

A06 Security Misconfiguration

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

python-jose

Fixed by upgrading

Yes

Solution

Upgrade to python-jose version 3.3.1 or later.

from jose import jwe

def decode(token):
    return jwe.decode(token, key='your-256-bit-secret')

token = "your_jwe_token_here"
decoded = decode(token)
print(decoded)

from jose import jwe

def decode(token):
    max_size = 1024 * 1024
    if len(token.encode('utf-8')) > max_size:
        raise ValueError("Token size exceeds the maximum allowed limit.")
    
    return jwe.decode(token, key='your-256-bit-secret')

try:
    token = "your_jwe_token_here"
    decoded = decode(token)
    print(decoded)
except Exception as e:
    print(f"Error: {e}")

{
  "alg": "dir",
  "enc": "DEF",
  "zip": "DEF",
  "payload": "A very large payload that compresses to a small size when decoded, potentially causing resource exhaustion."
}

@misc{vaitp:cve202433664,
  title        = {{Denial of service via high compression ratio in JSON Web Encryption tokens.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-33664},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-33664/}}
}