Bleichenbacher Attack in Strapi with Hmac Signatures

A Bleichenbacher attack is a chosen-ciphertext attack that exploits adaptive padding validation in RSA-based signature schemes. When HMAC-based signatures are used in Strapi without careful design, timing differences in signature verification can allow an attacker to iteratively learn the correct HMAC or forge valid tokens. Strapi’s admin API and user registration endpoints commonly accept signed payloads (e.g., password reset tokens or JWTs with HMAC-based integrity), and if verification leaks success/failure via timing or error messages, the attack surface expands.

Consider a Strapi endpoint that verifies an HMAC signature before processing a JSON payload:

const crypto = require('crypto');
const secret = process.env.HMAC_SECRET;
function verifySignature(body, receivedSignature) {
  const expected = crypto.createHmac('sha256', secret).update(JSON.stringify(body)).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(receivedSignature));
}

If verifySignature does not use constant-time comparison (or falls back to a simple string equality), an attacker can send modified tokens and observe response timing or error messages to gradually recover the HMAC. Strapi’s default JSON body parsing and loosely structured error handling may inadvertently expose whether a signature was malformed, truncated, or mismatched, enabling a Bleichenbacher-style adaptive attack. In OAuth flows or custom JWT validation plugins, missing padding checks and non-constant-time verification compound the risk.

Moreover, if Strapi exposes an unauthenticated endpoint that accepts signed input (e.g., a webhook or callback URL), an attacker can probe signatures without credentials. By submitting ciphertexts or tokens with incremental modifications and measuring response behavior—such as 401 vs 200, or distinct error payloads—an attacker can infer valid HMAC bytes. This becomes critical when HMACs protect sensitive actions like email confirmation or role escalation, as token validity can be narrowed byte-by-byte.

In practice, this maps to common OWASP API Top 10 categories such as Broken Object Level Authorization (BOLA) and Security Misconfiguration, especially when signature verification logic is inconsistent across endpoints. The attack does not require authentication, leveraging the API’s own validation path to extract information iteratively.

Remediation centers on ensuring signature verification is performed in constant time, rejecting malformed inputs early, and avoiding information leakage through errors or timing. Always use cryptographic libraries that provide constant-time comparison and avoid branching on secret-dependent values.

Use crypto.timingSafeEqual with fixed-length buffers and ensure both sides of comparison have identical length. Never compare strings directly with === for security-sensitive tokens. Below is a hardened verification pattern for Strapi controllers or services:

const crypto = require('crypto');
const secret = process.env.HMAC_SECRET;
function safeVerify(body, receivedSignature) {
  if (typeof receivedSignature !== 'string' || !/^[0-9a-f]{64}$/i.test(receivedSignature)) {
    throw new Error('invalid_signature');
  }
  const expected = crypto.createHmac('sha256', secret).update(JSON.stringify(body)).digest('hex');
  const received = Buffer.from(receivedSignature, 'hex');
  const expectedBuf = Buffer.from(expected, 'hex');
  if (received.length !== expectedBuf.length) {
    throw new Error('invalid_signature');
  }
  crypto.timingSafeEqual(received, expectedBuf);
}

Additionally, enforce strict input validation before verification and return uniform error responses. In Strapi, customize the error handler to avoid leaking stack traces or validation details:

// src/middlewares/hmac-verify.js
module.exports = (config, { strapi }) => {
  return async (ctx, next) => {
    const sig = ctx.request.header['x-api-signature'];
    if (!sig) { ctx.throw(401, 'invalid_signature'); }
    try {
      const payload = ctx.request.body;
      const crypto = require('crypto');
      const secret = strapi.config.get('plugin.hmac.secret');
      const received = Buffer.from(sig, 'hex');
      const expected = crypto.createHmac('sha256', secret).update(JSON.stringify(payload)).digest();
      if (received.length !== expected.length) { ctx.throw(401, 'invalid_signature'); }
      crypto.timingSafeEqual(received, expected);
    } catch (err) {
      ctx.throw(401, 'invalid_signature');
    }
    await next();
  };
};

For broader protection, apply these principles across all endpoints that consume HMAC-signed data, including webhook handlers and OAuth callbacks. Combine with rate limiting and monitoring to detect probing behavior. The middleBrick CLI can help validate your implementation by scanning Strapi endpoints for insecure signature handling and timing-related anomalies, while the GitHub Action can enforce security gates in CI/CD pipelines.