Listen to this Post
How the mentioned CVE works:
The vulnerability is a Bleichenbacher padding oracle attack targeting the RSA encryption implementation. The Jervis SecurityIO class uses the Bouncy Castle `PKCS1Encoding` padding scheme with an `RSAEngine` for encryption and decryption. PKCS1 v1.5 padding has a known weakness where an attacker can interact with a system that acts as a “decryption oracle.” This oracle reveals whether a decrypted ciphertext has valid PKCS1 v1.5 padding or not through subtle differences in error messages or response times. By repeatedly sending strategically modified versions of an intercepted ciphertext to this oracle and observing the responses, an attacker can gradually deduce information about the encrypted data. Through a large number of such queries (often hundreds of thousands), the attacker can eventually decrypt the ciphertext without possessing the private key. In the context of Jervis, the vulnerable `rsaDecrypt` method could be probed if an attacker gains access to a system or service that uses it and can observe its behavior. The attack exploits the mathematical structure of RSA and the deterministic nature of the padding validation. Successfully exploiting this flaw could allow an attacker to decrypt the AES keys that Jervis uses to protect GitHub App authentication tokens. While the tokens are short-lived, compromise could lead to unauthorized access within the token’s validity window. The core issue is the use of the outdated and insecure PKCS1 v1.5 padding for encryption instead of the secure OAEP (Optimal Asymmetric Encryption Padding) scheme.
Platform: Jervis
Version: Pre-2.2
Vulnerability: Bleichenbacher Padding Oracle
Severity: Critical
date: 2024
Prediction: Version 2.2
What Undercode Say:
Analytics:
The vulnerable code is located in `SecurityIO.groovy`.
The `PKCS1Encoding` class is wrapped around an `RSAEngine`.
The `rsaDecrypt` method provides a direct decryption oracle path.
Impact is limited by local storage and short token lifespan.
Bash Commands and Codes:
Search for vulnerable PKCS1Encoding usage in codebase grep -r "PKCS1Encoding|RSAEngine" --include=".groovy" --include=".java" Example of vulnerable code lines (from provided links): new PKCS1Encoding(new RSAEngine()) cipher.init(false, key) Command to upgrade Jervis to patched version (example) ./gradlew updateToVersion --version=2.2
How Exploit:
Attacker captures or generates an RSA ciphertext encrypted for the target.
Attacker has access to a service or endpoint that uses the vulnerable `rsaDecrypt` method.
Attacker sends many manipulated ciphertexts to the service.
Service acts as an oracle, leaking padding validity via timing or errors.
Attacker analyzes responses to narrow down the possible plaintext.
After sufficient queries, the original plaintext (AES key) is fully recovered.
Attacker uses decrypted AES key to access encrypted GitHub tokens.
Protection from this CVE:
Migrate encryption padding from `PKCS1Encoding` to `OAEPEncoding`.
Upgrade Jervis to version 2.2 or later.
Ensure no legacy code directly uses the old `rsaDecrypt` method.
Use external secret management systems for highly sensitive data.
Impact:
Successful decryption of RSA-encrypted AES session keys.
Potential exposure of GitHub App authentication tokens.
Unauthorized API access within the token’s short (≤1 hour) validity period.
The impact is significantly higher if the vulnerable methods are exposed directly to consumers.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
