Bleichenbacher Attack in Fastapi (Python)

Remediation of the Bleichenbacher attack in Fastapi requires replacing insecure decryption patterns with modern, standardized cryptographic practices. The core fix involves using OAEP (Optimal Asymmetric Encryption Padding) instead of PKCS#1 v1.5, which eliminates the padding oracle vulnerability by ensuring that every ciphertext maps to a unique plaintext and that error messages do not distinguish between padding failures and other decryption errors.

In Python, this means using the cryptography library with asym_padding.OAEP() and ensuring that all decryption errors are handled uniformly. Below is a secure implementation that avoids response leakage and enforces constant-time behavior:

from fastapi import FastAPI, HTTPException
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding as asym_padding
from cryptography.hazmat.primitives import serialization

app = FastAPI()

# Load key securely — example only; use key management in prod
with open("public_key.pem", "rb") as f:
    public_key = serialization.load_pem_public_key(f.read())

# Secure endpoint — no response leakage    try:
        body = await request.json()
        ciphertext_hex = body.get("ciphertext")
        if not ciphertext_hex:
            raise HTTPException(status_code=400, detail="Missing ciphertext")
        
        ciphertext = bytes.fromhex(ciphertext_hex)
        # OAEP padding with SHA-256 — safe against padding oracles
        plaintext = public_key.decrypt(
            ciphertext,
            asym_padding.OAEP(mask_generation_function=asym_padding.MGF1(),
                               algorithm=hashes.SHA256(),
                               label=None)
        
        # Always return 200 with generic success message
        return {"result": "decryption successful", "data": "sensitive_value"}
        
    except Exception as e:
        # Uniform error handling — no details exposed
        raise HTTPException(status_code=400, detail="Invalid request")

This implementation uses OAEP padding, which is designed to prevent adaptive chosen-ciphertext attacks by incorporating randomness and hash functions that make padding structure unpredictable. Crucially, all errors are caught and returned as a generic 400 Invalid request with no stack traces or exception details. The endpoint never distinguishes between malformed input, padding errors, or decryption failures — closing the oracle.

Additionally, sensitive data like session tokens should never be stored encrypted with RSA in API payloads. Instead, use short-lived JWTs with HS256 signing and proper expiration, or encrypt with symmetric keys managed via KMS. If RSA must be used, ensure that decryption is performed in a secure enclave or HSM, and that all operations are logged for audit without exposing responses.

Fastapi developers should also enable strict input validation using Pydantic models that reject unexpected fields, reducing the chance that an attacker can inject malformed ciphertexts disguised as JSON. Combine this with middleBrick’s Input Validation scan, which will flag endpoints that accept encrypted blobs without proper schema enforcement.

Finally, consider deploying middleBrick’s CLI or GitHub Action to scan all Fastapi routes during CI/CD. The Pro plan offers continuous monitoring, so if a developer accidentally reintroduces a vulnerable decryption pattern, the system will alert you before deployment, helping maintain compliance with OWASP API Top 10 and PCI-DSS requirements around cryptographic controls.