Padding Oracle in Express with Dynamodb

A padding oracle attack can occur in an Express service that uses AWS DynamoDB for persistence when the application decrypts data and relies on error behavior to infer validity of the padding. If your Express API accepts an encrypted payload (for example, a serialized token or stored record), performs decryption using a block cipher such as AES, and then uses DynamoDB to retrieve or validate associated data, differences in error responses can become an oracle.

Consider an Express endpoint that accepts an encrypted identifier, decrypts it to obtain a DynamoDB key, and then queries a table. When the padding is incorrect, the decryption step may throw an error before the DynamoDB call; when the padding is correct but the key does not exist, DynamoDB may return a different observable behavior (for example, an empty item or a conditional check failure). An attacker who can send ciphertexts and observe timing differences, HTTP status codes, or distinct response messages can gradually learn plaintext without needing direct access to server logs or source code.

This combination is notable because DynamoDB itself does not introduce padding oracle issues; the risk arises from how Express handles decryption errors and how those errors differ from DynamoDB operational results. For instance, returning a 400 for bad padding and a 404 for missing items provides a useful differential to an attacker. Even when using high-level SDKs, it is possible to inadvertently expose timing or error-channel oracles if error handling is inconsistent across decryption and database steps.

Real-world impact aligns with the OWASP API Top 10 and can facilitate recovery of sensitive data, such as session tokens or impersonation keys, especially when encrypted values are stored in DynamoDB and retrieved by an unauthenticated endpoint. Attack patterns such as adaptive chosen-ciphertext attacks exploit these differentials to decrypt data or escalate privileges in ways that may bypass intended authorization checks.

middleBrick scans such endpoints (including those using DynamoDB) as part of its 12 parallel security checks, flagging authentication weaknesses, BOLA/IDOR risks, and data exposure that may accompany weak error handling. While the scanner detects and reports findings with remediation guidance, developers must ensure consistent error handling, use authenticated encryption with associated data (AEAD), and avoid branching logic on padding validity in Express routes.

To mitigate padding oracle risks in an Express service that uses DynamoDB, focus on making error paths uniform, avoiding decryption branching, and using strong cryptographic primitives. Below are concrete, realistic code examples you can apply in your Express routes.

1. Use AEAD (e.g., AES-GCM) and avoid padding-based modes

Prefer algorithms that do not require manual padding and that provide integrity verification. Node.js crypto supports AES-GCM, which eliminates padding oracle concerns related to block cipher modes like CBC.

const crypto = require('crypto');

function encryptAEAD(plaintext, key) {
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  let encrypted = cipher.update(plaintext, 'utf8');
  encrypted = Buffer.concat([encrypted, cipher.final()]);
  const tag = cipher.getAuthTag();
  return { iv: iv.toString('base64'), encryptedData: encrypted.toString('base64'), tag: tag.toString('base64') };
}

function decryptAEAD(encryptedPayload, key) {
  const { iv, encryptedData, tag } = encryptedPayload;
  const decipher = crypto.createDecipheriv('aes-256-gcm', Buffer.from(key, 'base64'), Buffer.from(iv, 'base64'));
  decipher.setAuthTag(Buffer.from(tag, 'base64'));
  let decrypted = decipher.update(Buffer.from(encryptedData, 'base64'));
  decrypted = Buffer.concat([decrypted, decipher.final()]);
  return decrypted.toString();
}

2. If you must use CBC, ensure constant-time verification and uniform errors

When using CBC, validate and decrypt in a way that does not leak padding validity through timing or status differences. Compute a MAC or HMAC over the ciphertext or use an envelope approach, and return a generic error for any decryption or verification failure.

const crypto = require('crypto');

function encryptCBC(plaintext, key, iv) {
  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
  let encrypted = cipher.update(plaintext, 'utf8');
  encrypted = Buffer.concat([encrypted, cipher.final()]);
  return encrypted;
}

// Example MAC-then-Encrypt pattern to verify integrity before processing
function verifyAndDecrypt(ciphertext, key, iv, receivedMac) {
  const computedMac = crypto.createHmac('sha256', key).update(ciphertext).digest('hex');
  // Use timing-safe comparison to avoid oracle
  if (!crypto.timingSafeEqual(Buffer.from(computedMac), Buffer.from(receivedMac))) {
    throw new Error('invalid_mac');
  }
  const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
  let decrypted = decipher.update(ciphertext);
 decrypted = Buffer.concat([decrypted, decipher.final()]);
  return decrypted.toString();
}

// In Express, ensure errors map to a consistent response
app.post('/data', (req, res) => {
  try {
    const payload = JSON.parse(req.body);
    const key = Buffer.from(process.env.KEY, 'base64');
    const iv = Buffer.from(payload.iv, 'base64');
    const ciphertext = Buffer.from(payload.encrypted, 'base64');
    const mac = payload.mac;
    const decrypted = verifyAndDecrypt(ciphertext, key, iv, mac);
    // Use decrypted value as DynamoDB key; handle missing items uniformly
    return res.status(200).json({ data: decrypted });
  } catch (err) {
    // Do not distinguish between padding, MAC, or item-not-found errors
    return res.status(400).json({ error: 'invalid_request' });
  }
});

When integrating DynamoDB, avoid returning different error shapes or status codes based on whether an item exists versus whether decryption failed. Use conditional checks that do not rely on error-based branching for security decisions.

const { DynamoDBClient, GetCommand } = require('@aws-sdk/client-dynamodb');
const client = new DynamoDBClient({ region: 'us-east-1' });

app.get('/record/:id', async (req, res) => {
  const { id } = req.params;
  // Assume id was obtained securely after uniform decryption/validation
  const cmd = new GetCommand({ TableName: 'SecureTable', Key: { pk: { S: id } } });
  try {
    const result = await client.send(cmd);
    if (!result.Item) {
      return res.status(404).json({ error: 'not_found' });
    }
    return res.json({ data: result.Item });
  } catch (dbErr) {
    return res.status(500).json({ error: 'server_error' });
  }
});