Poodle Attack with Basic Auth

The Poodle attack (Padding Oracle On Downgraded Legacy Encryption) exploits weaknesses in SSL/TLS implementations, but its manifestation in Basic Auth contexts is particularly insidious. When Basic Auth is used over HTTP instead of HTTPS, attackers can intercept credentials transmitted in base64 encoding. While base64 isn't encryption, the principle of credential exposure during protocol downgrade applies similarly.

In Basic Auth scenarios, Poodle-like attacks often occur when:

• Servers accept both HTTP and HTTPS connections, allowing man-in-the-middle attackers to force protocol downgrades
• Authentication headers are transmitted over unencrypted channels
• Legacy systems still support SSLv3 or TLS 1.0 where padding oracle vulnerabilities exist
• Proxy servers or load balancers mishandle SSL termination, exposing credentials in transit

The specific attack pattern involves an attacker intercepting the Authorization header containing Base64-encoded credentials like Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=. While Basic Auth itself doesn't use padding like block ciphers, the vulnerability manifests when combined with SSL/TLS downgrade attacks that expose the authentication mechanism.

// Vulnerable Basic Auth over HTTP (Poodle-like exposure)
app.get('/api/protected', (req, res) => {
  const authHeader = req.headers.authorization;
  if (!authHeader || !authHeader.startsWith('Basic ')) {
    return res.status(401).send('Missing Basic Auth');
  }
  // Credentials transmitted in clear text over HTTP!

The real danger emerges when attackers combine protocol downgrade techniques with Basic Auth interception, effectively creating a Poodle-like credential exposure scenario even though Basic Auth doesn't use padding itself.