Beast Attack in Sails with Hmac Signatures

A Beast Attack in the context of Sails with Hmac Signatures arises when an attacker can submit chosen plaintexts and observe resulting signatures, exploiting patterns in how HMAC is applied across blocks. This typically occurs when Sails applications implement custom request signing (for example, to verify webhook origin or API client authenticity) using an iterative HMAC that processes a message block-by-block without proper safeguards. If the same key is used for multiple operations or if the signature does not cover the full message length and order, an attacker may recover earlier blocks or infer relationships between messages.

Consider an endpoint that accepts a JSON payload and an X-Signature header computed as Hmac-SHA256 of the raw request body using a shared secret. If Sails does not enforce strict message canonicalization (consistent ordering of keys, no extra whitespace, deterministic serialization), two semantically equivalent payloads can produce different byte representations. An attacker can leverage this to submit modified plaintexts while reusing a valid signature for a known prefix, effectively performing a byte-at-a-time recovery. This is a classic BEAST-style adaptive chosen-plaintext scenario applied to the HMAC computation layer rather than TLS, but the principle of iterative chaining and lack of per-message randomness remains.

In Sails, this can surface when middleware constructs the signing input by concatenating selected headers and a body field in a non-deterministic way, or when the application reuses a cryptographic context across requests. The vulnerability is not in HMAC-SHA256 itself, but in how the signing workflow is integrated: missing per-request nonces, missing scope binding (e.g., timestamp or request-id), and failure to validate content-type and encoding can turn a seemingly secure Hmac Signature scheme into an oracle for an adaptive attack.

Another realistic scenario involves webhook signatures where Sails receives an X-Hub-Signature-256 and recalculates Hmac using the shared app secret. If the comparison is performed with a vulnerable string equality check (e.g., starting with == instead of a constant-time comparison), an attacker can perform offline brute force or timing-based leakage to infer the secret. Even when comparison is constant-time, if the endpoint reflects information about signature validity or processes partial matches differently, it may aid adaptive chosen-message attacks that align with BEAST-like characteristics.

To detect this pattern via middleBrick, a scan can exercise endpoints that accept mutable body content alongside Hmac-signed headers, testing whether different canonical forms of the same logical payload produce the same signature and whether timing or error behavior changes with modified blocks. The scanner’s Input Validation and Authentication checks can surface inconsistent canonicalization, missing nonces, and weak comparison practices that enable Beast-oriented exploitation chains in Hmac Signature flows within Sails.

Remediation focuses on canonicalization, binding, and safe comparison. Always serialize the payload deterministically before computing the HMAC, include a per-request nonce or timestamp, and use constant-time comparison. Below are concrete, working examples in Sails/Node.js style that avoid the patterns that enable Beast-like attacks.

Example 1: Deterministic body signing with nonce and constant-time compare

const crypto = require('crypto');
const nonceStore = new Set();

function generateSignature(body, secret, nonce, timestamp) {
  const payload = JSON.stringify(body);
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(nonce);
  hmac.update(timestamp);
  hmac.update(payload);
  return hmac.digest('hex');
}

function verifySignature(body, receivedSignature, secret, nonce, timestamp) {
  const expected = generateSignature(body, secret, nonce, timestamp);
  // constant-time compare to avoid timing leaks
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(receivedSignature));
}

// In a Sails controller action
module.exports.create = async function (req, res) {
  const body = req.allParams();
  const nonce = req.headers['x-nonce'];
  const timestamp = req.headers['x-timestamp'];
  const receivedSignature = req.headers['x-signature'];

  if (!nonce || !timestamp || !receivedSignature) {
    return res.badRequest('Missing security headers');
  }

  // Reject replayed nonces
  if (nonceStore.has(nonce)) {
    return res.forbidden('Replay detected');
  }
  nonceStore.add(nonce);

  // Keep nonces bounded in production (e.g., sliding window)
  if (!verifySignature(body, receivedSignature, sails.config.custom.hmacSecret, nonce, timestamp)) {
    return res.unauthorized('Invalid signature');
  }

  // Proceed with validated body
  return res.ok({ status: 'ok' });
};

Example 2: Webhook signature verification with canonical JSON and timestamp skew tolerance

const crypto = require('crypto');

function canonicalJson(obj) {
  // Ensure deterministic output: sorted keys, no extra whitespace
  return JSON.stringify(obj, Object.keys(obj).sort());
}

function computeWebhookSignature(payload, secret, timestamp) {
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(timestamp);
  hmac.update(canonicalJson(payload));
  return hmac.digest('hex');
}

module.exports.webhook = async function (req, res) {
  const payload = req.body; // raw parsed JSON
  const timestamp = req.headers['x-webhook-timestamp'];
  const signature = req.headers['x-webhook-signature'];
  const secret = sails.config.custom.webhookSecret;

  if (!timestamp || !signature) {
    return res.badRequest('Missing webhook headers');
  }

  // Allow small clock skew (e.g., 5 minutes)
  const skew = 300;
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp, 10)) > skew) {
    return res.badRequest('Timestamp out of skew tolerance');
  }

  const expected = computeWebhookSignature(payload, secret, timestamp);
  // Use timingSafeEqual to avoid early exit on mismatch
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
    return res.unauthorized('Invalid webhook signature');
  }

  // Process event
  return res.ok();
};

Operational practices to prevent Beast-like scenarios

• Include a unique per-request nonce or an ordered counter and store used nonces with a TTL to prevent replays.
• Bind the signature scope to a timestamp or request ID to prevent cross-request ambiguity.
• Ensure deterministic serialization for objects (sorted keys, consistent encoding) so equivalent logical payloads always hash to the same bytes.
• Use crypto.timingSafeEqual for comparison to avoid branching leaks that can assist adaptive attacks.
• Rotate secrets periodically and avoid key reuse across different security contexts (e.g., do not use the same Hmac key for both request signing and encryption).

By combining canonicalization, nonces, timestamp binding, and constant-time verification, Sails applications can use Hmac Signatures safely without exposing patterns that facilitate adaptive chosen-plaintext attacks similar to a Beast scenario.