Cloudflare Workers vulnerable to remote Spectre attack leaking JWTs

Cybersecurity researchers have demonstrated a remote Spectre attack against Cloudflare Workers that can leak JSON Web Tokens (JWT) from co-located workers in a production environment. The attack achieved a data leakage rate of up to 12 bits per second, which is approximately 360 times faster than a similar attack demonstrated in 2021.

The researchers utilized WebSocket communications to provide a remote timing source and leveraged Cloudflare’s Durable Objects to keep a single worker isolate active for up to 20 hours. By using a technique involving Pseudo Least Recently Used (PLRU) mechanisms, the team was able to amplify small cache timing differences into measurable signals despite network jitter.

Cloudflare stated that the attack has already been mitigated in its production environment. Improvements included enhancing Dynamic Process Isolation (DyPrIs), integrating the V8 Sandbox, and deploying Memory Protection Keys (MPK)-based in-process isolation. The company reported finding no indicators of active exploitation of this vulnerability over the past three years and noted that no customer data was accessed during the research experiments.