Bleichenbacher Attack in Nestjs with Api Keys

A Bleichenbacher attack is a cryptographic padding oracle attack originally described against PKCS#1 v1.5–encrypted data. In a NestJS API that uses API keys for authentication, the vulnerability arises when key validation is implemented as a remote timing oracle: for each candidate key, the server performs cryptographic operations whose success or failure leaks information through observable timing differences or error messages. If the API key verification logic decrypts or verifies a signature in a way where valid versus invalid keys produce different response times or distinct error responses, an attacker can iteratively submit modified keys and infer the correct key byte-by-byte without ever having direct access to the key material.

In NestJS, this often occurs when developers use low-level crypto primitives (for example, Node’s crypto module) to validate API keys that are encrypted or signed, and they inadvertently expose padding errors or comparison timing through HTTP responses. Consider a route that expects an encrypted API key; if the server returns a 401 with the message “invalid padding” for malformed ciphertext and a different message or timing behavior for valid padding but invalid key bits, the endpoint acts as a padding oracle. An attacker can automate requests with systematically altered ciphertexts, measuring response times and error payloads, and eventually recover the plaintext key. This turns an API key intended as a secret into a recoverable value merely by observing side-channel behavior in the validation path.

When API keys are passed in headers and processed through custom guards or interceptors, the risk is compounded if the validation logic is not constant-time. For example, a guard that decrypts the key using RSA-OAEP or PKCS#1 and then compares the result using a non-constant-time equality check can be exploited. Although NestJS does not introduce the flaw by itself, patterns common in its ecosystem—such as using crypto.privateDecrypt or crypto.verify without hardened padding and comparison strategies—can create a Bleichenbacher-like oracle. The attack combines the mathematical properties of RSA encryption with practical API-key handling in NestJS to expose a confidentiality bypass that can lead to unauthorized access when the discovered key is used elsewhere.

Remediation centers on removing timing leaks and ensuring validation does not act as a padding oracle. For API key handling, avoid performing low-level cryptographic decryption or signature verification in request paths when possible; instead, use opaque tokens or HMAC-based approaches where verification is constant-time. When cryptographic operations are necessary, use high-level, safe APIs with explicit padding modes and constant-time comparison, and ensure errors are generic.

Example 1: Constant-time comparison after decryption using Node’s crypto. This pattern avoids branching on key material and ensures errors do not distinguish padding failures from other issues.

import { Injectable, NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common';
import { Observable } from 'rxjs';
import { timingSafeEqual } from 'node:crypto';
import { from, of } from 'rxjs';

@Injectable()
export class ApiKeyValidationInterceptor implements NestInterceptor {
  private readonly storedKey: Buffer; // e.g., derived securely from env

  intercept(context: ExecutionContext, next: CallHandler): Observable {
    const request = context.switchToHttp().getRequest();
    const provided = request.headers['x-api-key'];
    if (!provided) {
      throw new Error('Unauthorized');
    }
    // Assume provided is base64-encoded and storedKey is the raw expected bytes
    const candidate = Buffer.from(provided, 'base64');
    // Use constant-time comparison; avoid early returns based on partial matches
    if (!this.constantTimeCheck(candidate, this.storedKey)) {
      throw new Error('Unauthorized');
    }
    return next.handle();
  }

  private constantTimeCheck(a: Buffer, b: Buffer): boolean {
    if (a.length !== b.length) {
      // Use a fixed-length dummy buffer to keep timing consistent
      const dummy = Buffer.alloc(Math.max(a.length, b.length));
      timingSafeEqual(dummy, dummy); // burn time to simulate same-cost operation
      return false;
    }
    return timingSafeEqual(a, b);
  }
}

import { Injectable, NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common';
import { Observable } from 'rxjs';
import { createHmac, timingSafeEqual } from 'node:crypto';

@Injectable()
export class HmacValidationInterceptor implements NestInterceptor {
  private readonly sharedSecret: Buffer;

  intercept(context: ExecutionContext, next: CallHandler): Observable {
    const request = context.switchToHttp().getRequest();
    const providedSignature = request.headers['x-api-signature'];
    const timestamp = request.headers['x-api-timestamp'];
    const nonce = request.headers['x-api-nonce'];
    if (!providedSignature || !timestamp || !nonce) {
      throw new Error('Unauthorized');
    }
    const message = `${timestamp}:${nonce}`;
    const mac = createHmac('sha256', this.sharedSecret).update(message).digest('base64');
    const candidate = Buffer.from(providedSignature, 'base64');
    const expected = Buffer.from(mac, 'base64');
    if (candidate.length !== expected.length || !timingSafeEqual(candidate, expected)) {
      throw new Error('Unauthorized');
    }
    return next.handle();
  }
}