Padding Oracle in Dynamodb

A padding oracle attack exploits the way a system reacts to invalid padding when decrypting ciphertext. In the context of DynamoDB, this can happen when an application stores encrypted attribute values (e.g., using AWS KMS‑encrypted fields) and returns distinct error messages or HTTP status codes depending on whether the padding validation fails versus other decryption errors.

Consider a Node.js service that encrypts a JSON payload with AES‑CBC/PKCS#7 before writing it to a DynamoDB item, then decrypts it on read. If the service catches a padding error and returns a 400 Bad Request with a message like "Invalid padding", while other decryption failures produce a generic 500 Internal Server Error, an attacker can iteratively modify ciphertext blocks and observe the response to learn the plaintext.

// Vulnerable example: encrypt/decrypt with AES‑CBC and leak padding errors
const crypto = require('crypto');
const AWS = require('aws-sdk');
const docClient = new AWS.DynamoDB.DocumentClient();

function encrypt(plaintext) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv('aes-256-cbc', Buffer.from(process.env.KEY, 'hex'), iv);
  let encrypted = cipher.update(plaintext, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  return iv.toString('hex') + ':' + encrypted;
}

function decrypt(ciphertext) {
  const [ivHex, encryptedHex] = ciphertext.split(':');
  const iv = Buffer.from(ivHex, 'hex');
  const encrypted = Buffer.from(encryptedHex, 'hex');
  const decipher = crypto.createDecipheriv('aes-256-cbc', Buffer.from(process.env.KEY, 'hex'), iv);
  let decrypted = decipher.update(encrypted, 'utf8', 'hex');
  try {
    decrypted += decipher.final('utf8');
    return decrypted;
  } catch (err) {
    // Padding error surfaces as an exception – we leak it
    throw new Error('Invalid padding');
  }
}

// Handler that reads from DynamoDB and returns error details
export.handler = async (event) => {
  const { id } = event.pathParameters;
  const item = await docClient.get({ TableName: 'Secrets', Key: { id } }).promise();
  if (!item.Item) return { statusCode: 404, body: 'Not found' };
  try {
    const plain = decrypt(item.Item.encryptedData.S);
    return { statusCode: 200, body: plain };
  } catch (e) {
    // Leaks padding‑oracle info
    return { statusCode: 400, body: e.message };
  }
};

This pattern matches real‑world padding‑oracle CVEs such as CVE‑2010‑3333 (ASP.NET) and CVE‑2016‑2107 (OpenSSL), where the distinction between padding validation failures and other decryption errors enables an attacker to recover plaintext without knowing the key.

Detecting a padding oracle in a DynamoDB‑backed API requires observing whether the service differentiates padding‑validation failures from other cryptographic or processing errors. A black‑box scanner like middlebrick can help by sending crafted ciphertexts and analysing the responses.

• Submit the target API URL to the middleBrick dashboard or run middlebrick scan https://api.example.com/secret/123.
• middleBrick’s Encryption check includes active probing for padding‑oracle behavior: it modifies the last block of a captured ciphertext, observes whether the response changes (e.g., 400 vs 500, different error messages), and flags the endpoint if a distinguishing pattern is found.
• The scan completes in 5–15 seconds and returns a risk score (A–F) with a per‑category breakdown; the Encryption category will show a high‑severity finding if a padding oracle is detected.
• Findings include the exact request/response pairs that revealed the oracle, severity rating, and remediation guidance.

Because middleBrick performs unauthenticated, black‑box testing, it does not require any agents, credentials, or configuration—just the public endpoint URL.

The most reliable way to eliminate a padding oracle is to avoid CBC mode with unauthenticated padding altogether. Use authenticated encryption (e.g., AES‑GCM) or leverage the AWS DynamoDB Encryption Client, which provides confidentiality and integrity and never returns padding‑error distinctions.

Below is a corrected implementation using the AWS Encryption SDK for JavaScript (v3) with AWS KMS. The encrypt/decrypt operations are atomic; any tampering results in a generic "Decryption failed" error that does not leak padding information.

const { KMS } = require('@aws-sdk/client-kms');
const { encrypt, decrypt, StrictAwsKmsKeyring } = require('@aws-crypto/client-node');
const { utf8 } = require('@aws-crypto/util');
const AWS = require('aws-sdk');
const docClient = new AWS.DynamoDB.DocumentClient();

const kmsClient = new KMS({});
const keyArn = process.env.KMS_KEY_ARN; // e.g., arn:aws:kms:us-east-1:123456789012:key/abcd-efgh
const keyring = new StrictAwsKmsKeyring({ keyArn });

async function encryptAndStore(id, plaintext) {
  const { result: ciphertext } = await encrypt(keyring, utf8.fromUtf8(plaintext));
  await docClient.put({
    TableName: 'Secrets',
    Item: { id, encryptedData: { S: ciphertext.toString('base64') } }
  }).promise();
}

async function retrieveAndDecrypt(id) {
  const item = await docClient.get({ TableName: 'Secrets', Key: { id } }).promise();
  if (!item.Item) throw new Error('Not found');
  const ciphertext = Buffer.from(item.Item.encryptedData.S, 'base64');
  const { plaintext } = await decrypt(keyring, ciphertext);
  return utf8.toUtf8String(plaintext);
}

// Handler – any decryption failure yields a generic 500
export.handler = async (event) => {
  try {
    const { id } = event.pathParameters;
    const plain = await retrieveAndDecrypt(id);
    return { statusCode: 200, body: plain };
  } catch (err) {
    // Do not expose whether it was a padding, MAC, or other error
    console.error(err);
    return { statusCode: 500, body: 'Internal server error' };
  }
};

If you must retain a custom encryption layer, ensure:

Use an authenticated mode such as AES‑GCM or AES‑CCM.
Never differentiate error messages based on padding validation; catch all decryption exceptions and return the same generic response.
Consider storing a separate HMAC (or using AWS KMS‑generated data keys) to verify integrity before attempting decryption.

After applying these changes, re‑run middlebrick scan to confirm the Encryption finding is resolved.