CVE-2025-24015

Executive Summary

CVE-2025-24015 is a critical security vulnerability in the Deno JavaScript, TypeScript, and WebAssembly runtime, affecting versions 1.46.0 through 2.1.6. The flaw lies in the implementation of AES-256-GCM and AES-128-GCM, where the authentication tag is not validated during decryption. This omission breaks the integrity guarantees of AES-GCM, effectively downgrading it to CTR mode. An attacker can tamper with ciphertexts or use incorrect keys without detection, and authenticated data (AAD) checks are also rendered ineffective. The vulnerability was patched in Deno version 2.1.7.

Supply Chain & Package Security

Deno is a runtime for JavaScript, TypeScript, and WebAssembly, often used in server-side applications and tooling. This vulnerability impacts any application relying on Deno's built-in crypto module for AES-GCM encryption. Since Deno packages and modules may be distributed via registries or directly embedded, the flaw could propagate through supply chains if applications depend on vulnerable Deno versions. Developers must update to Deno 2.1.7 or later to restore integrity guarantees.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD not assigned, but based on impact: 7.5 High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: None
• Threat Level: High – Exploitation requires no authentication and can be performed remotely, leading to undetected data tampering.

Deep Dive & Mechanics

AES-GCM (Galois/Counter Mode) provides both confidentiality and integrity through encryption and an authentication tag. The tag is computed over the ciphertext and AAD, and must be verified upon decryption. In vulnerable Deno versions, the decrypt function for AES-GCM does not validate this tag. This means:

• Tampered ciphertexts: An attacker can modify encrypted data without detection.
• Incorrect keys: Using a wrong key will not produce an error, leading to garbage plaintext.
• AAD bypass: Authenticated data set via set_aad is incorporated into the GCM hash but not validated, so AAD checks are ineffective.

The root cause is likely a missing or incorrect call to the underlying OpenSSL or Web Crypto API's tag verification step. The fix in version 2.1.7 ensures the tag is validated before returning plaintext.

Vulnerable vs. Patched Code

Vulnerable (Deno < 2.1.7):

// Example of vulnerable usage
const key = crypto.subtle.importKey("raw", keyBytes, { name: "AES-GCM" }, false, ["decrypt"]);
const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: iv, additionalData: aad }, key, ciphertext);
// No tag validation - returns plaintext even if tampered

Patched (Deno >= 2.1.7):

// Example of patched usage
const key = crypto.subtle.importKey("raw", keyBytes, { name: "AES-GCM" }, false, ["decrypt"]);
try {
  const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: iv, additionalData: aad }, key, ciphertext);
  // Tag validated - throws error if tampered
} catch (e) {
  console.error("Decryption failed: authentication tag mismatch");
}

Exploitation & Lab Setup

Red Team

1. Setup: Install Deno 2.1.6 on a test machine.
2. Encrypt a message using AES-GCM with a known key and IV.
3. Tamper with the ciphertext (e.g., flip a byte).
4. Decrypt using the same key and IV – the operation succeeds, returning corrupted plaintext.
5. Exploit: An attacker can modify encrypted data in transit or at rest without detection, potentially injecting malicious payloads.

Proof of Concept:

// vulnerable_decrypt.js
const key = await crypto.subtle.importKey("raw", new Uint8Array(32), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
const iv = crypto.getRandomValues(new Uint8Array(12));
const plaintext = new TextEncoder().encode("Sensitive data");
const encrypted = await crypto.subtle.encrypt({ name: "AES-GCM", iv: iv }, key, plaintext);
// Tamper with ciphertext
const tampered = new Uint8Array(encrypted);
tampered[0] ^= 0x01;
const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv: iv }, key, tampered);
console.log(new TextDecoder().decode(decrypted)); // Outputs corrupted data without error

Blue Team

1. Detection: Monitor for decryption operations that do not throw errors on tampered data.
2. Mitigation: Immediately update Deno to version 2.1.7 or later.
3. Validation: After patching, test that tampered ciphertexts cause decryption to fail.
4. Audit: Review logs for any successful decryption of known tampered data.

Indicators of Compromise (IOCs)

• Network: Unusual ciphertext modifications in transit (e.g., bit flips).
• System: Deno runtime version between 1.46.0 and 2.1.6.
• Behavior: Decryption operations that succeed despite tampered input.
• Logs: Absence of authentication tag errors in crypto operations.

Detection Engineering

YARA Rule

rule CVE_2025_24015_Deno_AES_GCM {
  meta:
    description = "Detects vulnerable Deno versions with missing AES-GCM tag validation"
    author = "Valters IT"
    date = "2025-02-20"
    reference = "CVE-2025-24015"
  strings:
    $vuln_version = /Deno [12]\.[0-9]+\.[0-6]/  // Matches 1.46.0 to 2.1.6
    $crypto_call = "AES-GCM"
  condition:
    $vuln_version and $crypto_call
}

Sigma Rule

title: CVE-2025-24015 - Deno AES-GCM Authentication Tag Bypass
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects decryption operations in Deno that may bypass AES-GCM tag validation
author: Valters IT
logsource:
  product: application
  service: deno
detection:
  selection:
    EventID: 4104  # PowerShell script block logging (example)
    ScriptBlockText|contains: "AES-GCM"
  condition: selection
falsepositives:
  - Legitimate use of AES-GCM in patched versions
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-24015 - Deno AES-GCM Tag Bypass Attempt"; flow:to_server; content:"AES-GCM"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Deno to version 2.1.7 or later.
2. Workaround: If upgrade is not possible, avoid using AES-GCM in Deno and switch to other authenticated encryption modes (e.g., AES-CBC with HMAC).
3. Validation: After patching, test that decryption of tampered ciphertexts fails.
4. Monitoring: Enable logging for crypto operations and alert on successful decryption of known tampered data.
5. Supply Chain: Update all dependencies that rely on Deno's crypto module.

Valters IT
Securing Digital Frontiers