Cloudflare Workers Hit by Spectre Attack Leaking JWTs
Researchers demonstrate a remote Spectre attack on Cloudflare Workers that exfiltrates JWTs from co-located processes. The attack achieves data leakage at 12 bits per second—360x faster than previous attempts.
TL;DR
- Cybersecurity researchers executed a remote Spectre attack on Cloudflare Workers.
- The attack successfully leaked a JWT from a co-located victim Worker.
- Data exfiltration reached speeds of up to 12 bits per second.
- This represents a 360x improvement over similar attacks from 2021.
- Organizations using Cloudflare Workers should review isolation and side-channel defenses.
Security researchers have revealed a sophisticated remote Spectre attack targeting Cloudflare Workers, a serverless computing platform. The attack managed to leak sensitive data—including a JSON Web Token (JWT)—from a co-located victim process within the same infrastructure. This breakthrough demonstrates a significant increase in exploit speed compared to earlier attempts, raising concerns about tenant isolation in shared cloud environments.
The demonstration was conducted under controlled conditions using both attacker-controlled and victim Workers deployed in Cloudflare’s production environment. While no real customer data was compromised, the findings underscore persistent side-channel risks even in hardened platforms. Organizations relying on serverless architectures must now re-evaluate their assumptions around process-level security boundaries.
Attack Overview
- The attack exploited speculative execution flaws akin to the Spectre vulnerability.
- It targeted memory isolation between co-located Cloudflare Workers.
- Researchers achieved remote exploitation without direct access to the victim Worker.
- A JSON Web Token (JWT) was successfully extracted during the experiment.
- The leakage rate peaked at 12 bits per second, far surpassing prior benchmarks.
Implications for Developers and Teams
- Serverless platforms like Cloudflare Workers may still be vulnerable to cross-tenant side-channel attacks.
- Teams should audit their use of secrets and tokens within shared execution environments.
- Performance optimizations such as speculative execution can introduce unforeseen risks.
- Defense-in-depth strategies including token encryption and minimal privilege principles are critical.
- Continuous monitoring for anomalous inter-function communication may help detect abuse patterns.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.