PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle

The vulnerability exists in the PHP JWT Library's RSACrypt::decryptWithRSA15() function, which performs RSAES-PKCS1-v1_5 decryption by checking padding after the RSA decryption primitive. It throws an exception immediately upon detecting malformed padding instead of implementing the implicit rejection countermeasure mandated by RFC 3447 §7.2.2 and RFC 8017 §7.1.2. This behavior creates a Bleichenbacher/Marvin padding oracle, where attackers can differentiate between padding failures, incorrect CEK lengths, and successful AEAD decryption by measuring timing differences amplified by ciphertext size. The vulnerability affects configurations that register RSA1_5 for decryption and hold an RSA private key. The patch introduces constant-time implicit rejection by returning a random CEK of expected size on padding failure and always performing the AEAD step uniformly, removing observable differences. Migration to RSA-OAEP is strongly recommended.

An attacker can exploit timing side channels to distinguish padding errors during RSA1_5 decryption, enabling a Bleichenbacher/Marvin padding oracle attack. This can lead to recovery of the wrapped content encryption key (CEK), compromising the confidentiality of encrypted tokens. The vulnerability affects applications that use RSA1_5 key encryption with an RSA private key. No known exploits in the wild have been reported.

A patch is available that implements the required implicit rejection countermeasure in constant time, neutralizing the Bleichenbacher padding oracle. Users should apply this patch to versions prior to 3.4.10, 4.0.0 up to but not including 4.0.7, and 4.1.0 up to but not including 4.1.7. Additionally, users are strongly advised to migrate to RSA-OAEP or RSA-OAEP-256 algorithms and avoid enabling RSA1_5 for untrusted tokens.