Preventing Padding Oracle Attacks

An e-commerce application uses AES-CBC encryption to encrypt user data such as session cookies or sensitive information. It may be vulnerable to a Padding Oracle attack. It is a type of cryptographic attack that exploits the way padding errors are handled in encrypted messages. This attack is particularly relevant to block cipher encryption modes that use padding, such as CBC (Cipher Block Chaining) mode. The attack allows an attacker to decrypt ciphertext or even encrypt their own messages without knowing the encryption key.

Explanation of Padding Oracle Attack

When data is encrypted using a block cipher, it often needs to be padded to make sure it fits into the fixed-size blocks required by the encryption algorithm. Padding schemes, like PKCS7, add extra bytes to the plaintext to ensure it aligns with the block size. During decryption, the padding is removed, and if the padding is incorrect, an error is generated.

A Padding Oracle attack takes advantage of these padding error messages. Here's a simplified version of how it works:

• Encryption: A plaintext message is padded and then encrypted using a block cipher in CBC mode.

• Transmission: The encrypted message (ciphertext) is transmitted to the recipient.

• Decryption and Padding Validation: The recipient decrypts the message and checks the padding. If the padding is incorrect, an error message is returned.

An attacker can send modified versions of the ciphertext to the decryption oracle (the recipient who decrypts the message and checks the padding) and observe whether a padding error occurs. By carefully crafting these modified ciphertexts and analyzing the responses, the attacker can gradually reveal the plaintext.

Mitigation Strategies

1. Padding Oracle Protection module works on the URL, cookie or parameter that is encrypted. Consult with your application developer to find inputs that are individually encrypted.
2. Go to Web Protection > Advanced Protection > Padding Oracle Protection.
3. Click Create New, then configure these settings:

Name	Type a unique name that can be referenced in other parts of the configuration. The maximum length is 63 characters.
Action	Alert & Deny
Severity	Medium
Trigger Action	Select which trigger, if any, that the FortiWeb appliance will use when it logs and/or sends an alert email about a violation of the rule. For details, see Blocked IPs.

4. Click OK.
5. Click Create New.
6. Configure these settings:

Host Status	Enable.
Host	www.example.com
Type	Select whether the Preventing Padding Oracle Attacks field must contain a literal URL (Simple String), or a regular expression designed to match multiple URLs (Regular Expression).
Protected URL	Enter the URL to be protected.
Protected Target	Indicate which parts of the client’s requests should be examined for padding attack attempts: URL (e.g. parameters are embedded in the URL, such as /user/0000012FE03BC2) Parameter (e.g. parameters are appended in a traditional GET URL parameter, such as /index.php?user=0000012FE03BC2or POST body) Cookie

7. Click OK.
8. To apply the rule, select it in an inline protection profile or an Offline Protection profile. For details, see Configuring a protection profile for inline topologies or Configuring a protection profile for an out-of-band topology or asynchronous mode of operation.

By performing the steps above, the necessary encrypted components are protected against potential Padding Oracle attack, thus ensuring the confidentiality and integrity of sensitive information.