padding-oracle-anti-pattern

name	padding-oracle-anti-pattern
description	Security anti-pattern for padding oracle vulnerabilities (CWE-649). Use when generating or reviewing code that decrypts CBC-mode ciphertext, handles decryption errors, or returns different errors for padding vs other failures. Detects error message oracles.

Padding Oracle Anti-Pattern

Severity: High

Summary

Applications leak padding correctness during decryption through different error messages ("Invalid Padding" vs. "Decryption Failed") or timing differences. Attackers manipulate ciphertext and observe responses to decrypt entire messages byte-by-byte without knowing the key, breaking confidentiality.

The Anti-Pattern

The anti-pattern is using CBC mode and returning different responses based on decryption error type.

BAD Code Example

# VULNERABLE: The decryption function returns different error messages.
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import padding
from flask import request

KEY = b'sixteen byte key' # Should be randomly generated and managed securely

@app.route("/decrypt")
def decrypt_data():
    encrypted_data = request.args.get('data').decode('hex')
    iv = encrypted_data[:16]
    ciphertext = encrypted_data[16:]

    cipher = Cipher(algorithms.AES(KEY), modes.CBC(iv))
    decryptor = cipher.decryptor()

    :
        decrypted_padded = decryptor.update(ciphertext) + decryptor.finalize()

        
        unpadder = padding.PKCS7().unpadder()
        unpadded_data = unpadder.update(decrypted_padded) + unpadder.finalize()

         , 

     ValueError  e:
        
        
        
           (e).lower():
             , 
        :
             ,