| Details | |
|---|---|
| Alert ID | 90024 |
| Alert Type | Active |
| Status | release |
| Risk | High |
| CWE | 209 |
| WASC | 20 |
| Technologies Targeted | All |
| Tags |
CWE-209 OWASP_2017_A06 OWASP_2021_A02 POLICY_QA_FULL WSTG-V42-CRYP-02 |
| More Info |
Scan Rule Help |
Summary
By manipulating the padding on an encrypted string, an attacker is able to generate an error message that indicates a likely ‘padding oracle’ vulnerability. Such a vulnerability can affect any application or framework that uses encryption improperly, such as some versions of ASP.net, Java Server Faces, and Mono. An attacker may exploit this issue to decrypt data and recover encryption keys, potentially viewing and modifying confidential data. This rule should detect the MS10-070 padding oracle vulnerability in ASP.net if CustomErrors are enabled for that.
Solution
Update the affected server software, or modify the scripts so that they properly validate encrypted data before attempting decryption.Other Info
References
- https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070
- https://www.mono-project.com/docs/about-mono/vulnerabilities/
- https://bugzilla.redhat.com/show_bug.cgi?id=623799