Overview
In the realm of cybersecurity, a newly discovered vulnerability, CVE-2025-54887, has been identified in the Ruby implementation of JSON Web Encryption (JWE) standard, ‘jwe’. The vulnerability affects versions 1.1.0 and below. It is an alarming issue as it allows the authentication tags of encrypted JWEs to be brute-forced, potentially leading to loss of confidentiality. This can provide malicious users with the ability to craft arbitrary JWEs. The danger is pronounced for users as JWEs can be modified to decrypt to arbitrary values, decrypted by observing parsing differences and the GCM internal GHASH key can be recovered.
Vulnerability Summary
CVE ID: CVE-2025-54887
Severity: Critical (CVSS: 9.1)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise and potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
jwe (Ruby) | 1.1.0 and below
How the Exploit Works
The vulnerability in the ‘jwe’ Ruby implementation of JWE relies on weak security mechanisms in the encryption process. The flaw allows authentication tags to be brute-forced, enabling the creation of arbitrary JWEs. This vulnerability can be exploited over the network without requiring user interaction or privileges. Moreover, due to the ability to observe parsing differences and recover the GCM internal GHASH key, an attacker can manipulate JWEs to decrypt to any value they desire. This not only compromises the confidentiality of the JWEs but also exposes the potentially sensitive data they contain.
Conceptual Example Code
Here is a
conceptual
example of how the vulnerability might be exploited. This pseudocode demonstrates a brute-force attack on the authentication tags of encrypted JWEs:
def brute_force_attack(jwe_tag)
possible_tags = generate_possible_tags()
possible_tags.each do |tag|
if decrypt_jwe(tag, jwe_tag) == true
puts "Decrypted JWE: #{decrypt_jwe(tag, jwe_tag)}"
break
end
end
end
brute_force_attack(target_jwe_tag)In this pseudocode, `generate_possible_tags()` would generate all possible authentication tags, and `decrypt_jwe()` would attempt to decrypt the JWE using each tag. If the decryption is successful, the decrypted JWE is outputted, and the brute force attack stops.
Mitigation
Users are advised to upgrade to version 1.1.1 as this issue has been fixed in this release. As the GHASH key may have been leaked, users must also rotate the encryption keys after upgrading. As a temporary mitigation, users can apply vendor patches or use a Web Application Firewall (WAF) or Intrusion Detection System (IDS).