Bleichenbacher Attack in Strapi with Api Keys

A Bleichenbacher attack is a chosen-ciphertext attack against RSA-based encryption or signature schemes that rely on PKCS#1 v1.5 padding. In Strapi, if API keys are handled with RSA and PKCS#1 v1.5 padding, an attacker can iteratively send modified ciphertexts and observe whether padding is valid to gradually recover the plaintext. When API keys are stored or transmitted using RSA with PKCS#1 v1.5, and the server returns distinguishable errors for valid versus invalid padding, the attack becomes practical.

Consider a Strapi setup where API keys are encrypted or signed with RSA PKCS#1 v1.5. An attacker who can obtain decryption or verification oracles (e.g., an endpoint that decrypts or verifies an API key and returns distinct error messages) can launch a Bleichenbacher attack. By submitting many crafted ciphertexts and observing responses like Invalid padding versus Invalid signature, the attacker can deduce the underlying API key bit by bit. This can lead to full recovery of the key without needing the private key, enabling impersonation and unauthorized access to Strapi’s admin APIs.

To detect this pattern, middleBrick’s input validation and authentication checks analyze error consistency and timing behavior across repeated requests. The scanner flags scenarios where error responses differ based on padding validity and where RSA PKCS#1 v1.5 is used with API keys. This helps identify whether your Strapi deployment is susceptible to Bleichenbacher-style oracle attacks via API key handling.

Remediation focuses on replacing RSA PKCS#1 v1.5 with safer cryptographic primitives and ensuring API key handling does not leak padding-related errors. Use RSA with Optimal Asymmetric Encryption Padding (OAEP) or, better yet, use symmetric keys or Elliptic Curve cryptography where appropriate. Always use constant-time operations for comparisons and ensure error messages are uniform and do not distinguish between padding failures and other issues.

In Strapi, configure your API key generation and verification to avoid PKCS#1 v1.5. Below are concrete code examples for safer practices.

Example: Generating and using a symmetric API key (recommended)

// config/api-keys.js
module.exports = {
  keys: [
    {
      name: 'service-access-key',
      type: 'string',
      value: crypto.randomBytes(32).toString('base64'), // 256-bit symmetric key
      expiresAt: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000), // 90 days
    },
  ],
};

Example: Verifying an API key with constant-time comparison

// services/api-key-service.js
const crypto = require('crypto');

module.exports = {
  verifyKey(candidate, expected) {
    // Use timing-safe compare to avoid leaking info via timing differences
    return crypto.timingSafeEqual(
      Buffer.from(candidate),
      Buffer.from(expected)
    );
  },
};

Example: If you must use RSA, prefer OAEP (Node.js)

// services/rsa-service.js
const crypto = require('crypto');

const publicKey = `-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWxKLKzXhJpJ7Z8gK3R0
...
-----END PUBLIC KEY-----`;

const privateKey = `-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgz...
-----END PRIVATE KEY-----`;

function encryptOAEP(message) {
  return crypto.publicEncrypt(
    {
      key: publicKey,
      padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
      oaepHash: 'sha256',
    },
    Buffer.from(message)
  );
}

function decryptOAEP(ciphertext) {
  return crypto.privateDecrypt(
    {
      key: privateKey,
      padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
      oaepHash: 'sha256',
    },
    ciphertext
    );
}

Additional Strapi-specific measures

• Ensure error responses are generic (e.g., ‘Invalid request’) and do not reveal whether a padding or signature check failed.
• Rotate API keys regularly and store them securely using environment variables or a secrets manager; avoid committing keys to version control.
• Use rate limiting and monitoring to detect unusual request patterns that may indicate an active Bleichenbacher probe.

By moving away from PKCS#1 v1.5 for API key operations and using constant-time verification, Strapi deployments can effectively mitigate Bleichenbacher-style oracle attacks while maintaining compatibility with modern authentication flows.