Padding Oracle in Feathersjs with Hmac Signatures

A padding oracle attack can occur in FeathersJS applications that use Hmac Signatures for request authentication when the server reveals information about the validity of a padding structure through different responses or timing. In FeathersJS, authentication schemes often rely on signing a payload or a subset of the request (method, path, timestamp, body) using Hmac with a shared secret. If a server processes incoming Hmac signatures in an implementation that uses a low-level padding scheme such as PKCS#7 and the padding validation is not performed in constant time, an attacker can iteratively submit modified signed requests and observe whether errors differ between valid padding and invalid padding. These differences can manifest as distinct HTTP status codes, distinct error messages, or measurable timing deviations, enabling the attacker to decrypt signed data or forge new signatures without knowing the secret.

Consider a FeathersJS service that expects an Hmac-SHA256 signature in a header (e.g., x-api-signature) computed over a canonical string that includes the request body. If the server deserializes the body, validates the signature, and then decrypts or verifies the body using a padding scheme where error handling distinguishes between a padding error and other validation failures, an attacker can exploit this behavior. For example, a malicious client may send ciphertexts where the last block is modified and observe whether the service returns a 400 with a generic error versus a 401 with an authentication failure, or whether responses arrive measurably faster when padding is correct. This distinction constitutes a padding oracle condition, even though the underlying transport may be HTTPS and the Hmac signature itself may be correctly formed for a tampered body.

In the context of OpenAPI/Swagger analysis that middleBrick performs, such a vulnerability would be flagged under Input Validation and Authentication checks when the scan detects inconsistent error handling across authenticated endpoints and signatures. The scanner does not perform active exploitation but highlights that the combination of Hmac Signatures and non-constant-time padding validation increases risk. Attack patterns like those outlined in OWASP API Top 10 — including Excessive Data Exposure and Security Misconfiguration — map to this scenario when error messages or status codes inadvertently disclose padding correctness. Real-world CVEs in related ecosystems have shown how attackers can recover plaintext from encrypted payloads when oracles exist; similar principles apply when FeathersJS services leak padding information via authenticated routes that use Hmac Signatures.

Remediation focuses on ensuring that signature verification and any subsequent cryptographic operations execute in constant time and return uniform error responses. In FeathersJS, this means standardizing error handling for authentication failures and avoiding branching logic that depends on padding correctness. Use a constant-time comparison for Hmac signatures and treat all signature validation failures as the same generic authentication error, without revealing whether the issue was padding, signature mismatch, or malformed input.

Below is a syntactically correct example of an Hmac Signature verification hook in FeathersJS that mitigates padding oracle risks by using constant-time comparison and uniform error handling:

const crypto = require('crypto');

// Constant-time comparison to avoid timing leaks
function safeCompare(a, b) {
  if (a.length !== b.length) {
    return false;
  }
  let result = 0;
  for (let i = 0; i < a.length; i++) {
    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
  }
  return result === 0;
}

// FeathersJS hook to verify Hmac signature
function verifyHmacSignature(options = {}) {
  return async context => {
    const { secret, signatureHeader = 'x-api-signature' } = options;
    const request = context.params && context.params.raw ? context.params.raw : context;
    const receivedSignature = request.headers && request.headers[signatureHeader];
    const method = request.method || (request.route && request.route.methods && Object.keys(request.route.methods)[0]);
    const url = request.originalUrl || (request.url ? request.url.split('?')[0] : '');
    const timestamp = request.headers && request.headers['x-request-timestamp'];
    const body = JSON.stringify(request.body || {});

    if (!receivedSignature || !secret) {
      throw new Error('Unauthenticated');
    }

    // Construct canonical string exactly as the client does
    const canonical = `${method.toUpperCase()}\n${url}\n${timestamp}\n${body}`;
    const expected = crypto.createHmac('sha256', secret).update(canonical).digest('hex');

    // Use constant-time comparison to prevent padding oracle via timing
    const isValid = safeCompare(expected, receivedSignature);
    if (!isValid) {
      throw new Error('Unauthenticated');
    }

    // Proceed only if signature is valid; no distinction in error path
    return context;
  };
}

// Apply the hook to a FeathersJS service
const app = require('@feathersjs/feathers')();
const hooks = require('feathers-hooks-common');

app.service('messages').hooks({
  before: {
    all: [verifyHmacSignature({ secret: process.env.API_SECRET })],
    find: [],
    get: [],
    create: [],
    update: [],
    patch: [],
    remove: []
  }
});

Additional recommendations include ensuring that any decryption or padding validation libraries you use are configured to fail with the same timing and error characteristics, and that your API responses do not include stack traces or detailed validation messages that could aid an attacker. middleBrick’s scans can help identify inconsistent error handling patterns across endpoints using Hmac Signatures; the Professional plan provides continuous monitoring and CI/CD integration to detect regressions before they reach production. If you use the CLI, you can run middlebrick scan <url> to validate that your endpoints exhibit uniform behavior; the GitHub Action can enforce a minimum security score and fail builds if deviations are detected; and the MCP Server allows you to trigger scans directly from AI coding assistants within your IDE.