Cloudflare Workers Vulnerability Exploited by Faster Spectre Attack

• •A Spectre-class attack on Cloudflare Workers can leak JWTs at 12 bits per second.
• •The attack is 360 times faster than previous methods and operates undetected.
• •Cloudflare has implemented enhanced security measures, including Memory Protection Keys.

Researchers demonstrated a Spectre-class side-channel attack against Cloudflare Workers, achieving JWT exfiltration at 12 bits per second, 360 times faster than previous methods. This attack exploited a feature in Cloudflare's infrastructure and was validated in a live production environment. The research involved teams from Cloudflare, Graz University of Technology, and the University of Edinburgh, confirming no evidence of exploitation in the wild. Cloudflare has since enhanced its Dynamic Process Isolation (DyPrIs) and integrated Memory Protection Keys (MPK) to mitigate the vulnerability. The attack's core relied on speculative type confusion in V8, Google's JavaScript engine. Despite the improvements, the findings indicate that Spectre attacks continue to evolve and pose a significant risk in cloud environments.