Bleichenbacher Attack in Firestore

The Bleichenbacher attack is a padding‑oracle vulnerability that affects RSA PKCS#1 v1.5 operations. While Firestore itself does not expose RSA primitives, developers often verify Firebase ID tokens (JWTs signed with RS256) manually before allowing writes to Firestore. If the verification routine uses a vulnerable crypto library or incorrectly handles the PKCS#1 v1.5 padding check, an attacker can forge a valid‑looking signature and bypass authentication, gaining unauthorized access to Firestore collections.

A typical vulnerable code path looks like this in a Cloud Function or custom backend that forwards requests to Firestore:

const crypto = require('crypto');
const { Buffer } = require('buffer');

// PUBLIC KEY fetched from https://www.googleapis.com/robot/v1/metadata/x509/[email protected]
function verifyIdTokenVulnerable(idToken) {
  const [headerB64, payloadB64, signatureB64] = idToken.split('.');
  const data = `${headerB64}.${payloadB64}`;
  const signature = Buffer.from(signatureB64, 'base64');

  // Get the PEM‑encoded RSA public key for the key ID in the header
  const kid = JSON.parse(Buffer.from(headerB64, 'base64').toString()).kid;
  const pem = PUBLIC_KEYS[kid]; // assume loaded earlier

  // Vulnerable: using crypto.verify with default PKCS#1 v1.5 padding without checking the exact padding structure
  const verifier = crypto.createVerify('RSA-SHA256');
  verifier.update(data);
  verifier.end();
  return verifier.verify(pem, signature, 'base64'); // returns true even if padding is malformed in some libraries
}

// Express middleware that calls the vulnerable verifier
app.use((req, res, next) => {
  const idToken = req.headers.authorization?.split(' ')[1];
  if (!idToken || !verifyIdTokenVulnerable(idToken)) {
    return res.status(401).send('Invalid token');
  }
  next(); // token accepted, Firestore calls follow
});

If the underlying crypto implementation (e.g., an outdated OpenSSL version linked into Node.js) is susceptible to the Bleichenbacher padding oracle, an attacker can iteratively submit modified signatures and observe whether the server rejects them due to a padding error or proceeds to treat the token as valid. Over many queries they can reconstruct a valid signature for an arbitrary payload, effectively forging an admin ID token and gaining full Firestore access.

Real‑world analogues include CVE‑2006-0905 (OpenSSL Bleichenbacher attack) and CVE‑2016-0702 (OpenSSL padding oracle in DTLS). Though those CVEs target TLS handshakes, the same principle applies to any RSA PKCS#1 v1.5 verification routine that leaks padding‑error information.

Detecting a Bleichenbacher‑type weakness in a Firestore‑protected API requires probing the authentication endpoint for padding‑oracle behavior. middleBrick’s unauthenticated black‑box scan includes an authentication check that attempts to submit malformed JWT signatures and observes whether the server distinguishes between "invalid signature" and "padding error" responses. When such a distinction is present, the scanner flags the endpoint as having a weak RSA verification mechanism.

You can initiate a scan from the CLI or the Web Dashboard:

# CLI – scan a Firestore‑backend URL
middlebrick scan https://us-central1-myproject.cloudfunctions.net/firestoreProxy

The scan completes in 5–15 seconds, runs 12 parallel checks (including Authentication, BOLA/IDOR, Input Validation, etc.), and returns a JSON report. In the report, look for a finding similar to:

{
  "category": "Authentication",
  "finding": "Potential RSA PKCS#1 v1.5 padding oracle detected in ID token verification",
  "severity": "high",
  "remediation": "Use a verified library (e.g., firebase-admin) to verify Firebase ID tokens; avoid manual crypto.verify calls."
}

Because middleBrick does not need agents, credentials, or configuration, you can run this scan against any staging or production endpoint that forwards requests to Firestore. The finding will also reference the OWASP API Security Top 10 category **API2:2023 – Broken Authentication**, helping you prioritize the fix within your compliance framework (e.g., SOC 2, ISO 27001).

The most reliable remediation is to delegate ID token verification to a well‑maintained library that correctly implements RSA PKCS#1 v1.5 validation without leaking padding‑error details. The Firebase Admin SDK provides such a verification method.

Replace the vulnerable manual verification with the Admin SDK’s verifyIdToken function. Below is a corrected Cloud Function example:

const { initializeApp, cert } = require('firebase-admin/app');
const { getAuth } = require('firebase-admin/auth');

// Initialize the admin app with a service account (or rely on default credentials in Cloud Functions)
initializeApp({
  credential: cert(require('./serviceAccountKey.json'))
});

auth = getAuth();

// Express middleware using the Admin SDK
app.use(async (req, res, next) => {
  const idToken = req.headers.authorization?.split(' ')[1];
  if (!idToken) {
    return res.status(401).send('Missing authorization token');
  }

  try {
    // This call performs RSA‑SHA256 verification internally and does not expose padding‑oracle side‑channels
    const decodedToken = await auth.verifyIdToken(idToken);
    // Optionally attach user info to request for downstream Firestore rules
    req.user = decodedToken;
    next();
  } catch (err) {
    // Any error (invalid signature, expired token, etc.) results in a generic 401
    console.warn('ID token verification failed:', err);
    return res.status(401).send('Invalid token');
  }
});

If you cannot use the Admin SDK (e.g., you are running in a non‑Node environment), ensure that any RSA verification routine you employ:

• Uses a constant‑time implementation that does not differentiate between padding errors and other verification failures.
• Checks the exact PKCS#1 v1.5 structure (0x00 0x02 … PS … 0x00 || ASN.1 || hash) before proceeding.
• Is sourced from a actively maintained cryptographic library (e.g., BoringSSL, OpenSSL 1.1.1+, or WebCrypto) and is kept up to date.

After applying the fix, rerun the middleBrick scan. The authentication finding should disappear, and the overall security score will improve (e.g., moving from a D to an A). This demonstrates how a simple library swap eliminates a class of cryptographic attacks while preserving the ability to secure Firestore access via standard Firebase authentication mechanisms.