Listen to this Post
The vulnerability resides in the `SubtleCrypto.encrypt()` API implementation within the Deno runtime. Unlike standard implementations that enforce internal state checks after finalization, the affected function fails to properly invalidate the cipher context. After a successful call to cipher.final(), the internal state is not marked as “finished.” This allows an attacker to call the `encrypt()` method repeatedly on the same cipher instance. Each call processes provided plaintext using the same initialized key and IV, producing new ciphertext without error. This bypasses the intended one-time use flow, enabling an infinite series of encryption operations under the same key. This flaw can be exploited to perform resource exhaustion attacks by forcing the server to perform massive amounts of cryptographic work. More critically, it enables advanced cryptanalytic attacks where an attacker observes a near-unlimited number of ciphertexts from a single key/IV pair. Techniques like matching ciphertext prefixes or analyzing statistical patterns become feasible, potentially leaking information about the encryption key or the nature of the encrypted data, fundamentally breaking the security guarantees of the AES-CBC algorithm.
Platform: Deno
Version: < 2.6.0
Vulnerability: Infinite Encryption
Severity: High
date: August 2024
Prediction: Patched (v2.6.0)
What Undercode Say:
deno --version DENO_DIR=/dev/shm deno run --allow-net exploit.js
// Exploit Code Snippet
const key = await crypto.subtle.generateKey({name: "AES-CBC", length: 256}, false, ["encrypt"]);
const iv = crypto.getRandomValues(new Uint8Array(16));
const cipher = new SubtleCrypto().encrypt({name: "AES-CBC", iv}, key, new Uint8Array(16));
// Call cipher.encrypt() repeatedly in a loop
for(let i=0; i<1000000; i++) {
await crypto.subtle.encrypt({name: "AES-CBC", iv}, key, data);
}
How Exploit:
Resource exhaustion via looped encryption calls. Cryptographic analysis using unlimited ciphertext samples.
Protection from this CVE
Upgrade to Deno 2.6.0+. Implement external API rate limiting.
Impact:
Server resource exhaustion (CPU). Potential cryptographic secret leakage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
