CBC Padding Oracle Bugs in Modern Bug Bounty Scope
Padding oracle attacks sound like CTF lore. They still appear when apps encrypt cookies or tokens with AES-CBC (or similar) and then speak too clearly about PKCS#7 validity. Different HTTP status, error string, or timing for "bad padding" versus "bad MAC" is enough.
You are not breaking AES. You are abusing a decryption endpoint that grades your ciphertext.
Spot the oracle
Targets: remember_me cookies, SSO blobs, password-reset tokens, feature-flag envelopes, and "encrypted" query parameters. Flip bits in the last blocks and watch responses.
Signals that matter:
- Distinct error messages:
padding invalidvsinvalid formatvs silent 302 - Stable timing gaps when MAC verification is skipped after padding failure
- Verbose .NET stack traces mentioning
cryptographicexceptionand padding
Mac-then-encrypt with a verified HMAC usually kills the oracle. Encrypt-then-MAC done wrong, or MAC omitted, keeps it alive. Some frameworks decrypt for logging even when the request later fails auth—still an oracle.
Base64url quirks create false leads. Normalize encoding before claiming a crypto bug; many "oracles" are just parsers coughing on + versus -. Confirm the ciphertext length matches block boundaries first.
Attack without wrecking production
A full plaintext recovery can mean thousands of requests per byte. That is how you get rate-limited or banned. For bug bounty, prefer a minimal demonstration:
- Show two ciphertexts that differ by a controlled bit flip.
- Document the distinct responses that reveal padding validity.
- Decrypt one or two chosen blocks of a cookie you own, enough to prove the primitive.
- Explain that the same oracle yields full recovery and possible forgery if integrity is absent.
Do not automate against shared login endpoints at full speed. Use a personal account token, backoff, and stop once impact is obvious.
If timing is your only signal, collect repeated samples and avoid network paths with huge jitter. A lab reproduction against a mirrored implementation can support the claim when production noise is ugly—say so explicitly.
Escalation and fixes
If you can decrypt session cookies, argue session disclosure. If the scheme lacks a MAC and you can forge ciphertext that decrypts to a useful structure, argue authentication bypass—but prove forgery on your own account first.
Remediation is standard: authenticated encryption (AES-GCM), or encrypt-then-MAC with a constant-time compare; reject all failures uniformly; rotate keys after exposure. Migrating cookies hurts less than arguing about timing forever.
CBC oracles are unevenly rewarded because some triage teams fear crypto. Meet them halfway: short differential proof, owned-account plaintext sample, clear integrity gap. Skip the thirty-page academic restatement. They have seen PadBuster screenshots before; they have not always seen a clean, scoped demonstration.
One aside: finding CBC alone is not a vulnerability. Finding CBC plus a padding oracle on a security cookie is. Keep that sentence near the top of the report so nobody skims past the impact.
If the oracle sits behind authenticated APIs only, say so. An oracle on an anonymous password-reset token is a different business risk than one that needs an existing session. Scope the blast radius the same way you would for IDOR: who can invoke the decrypting endpoint, and what plaintext is recoverable there.