Summary
A response-discrepancy vulnerability in Bouncy Castle's CMS RSA PKCS#1 v1.5 key-transport unwrapping can expose whether submitted ciphertext has valid padding. If an attacker has a captured CMS EnvelopedData message and can send many modified messages to a decryption service that reveals distinguishable failures, they may recover the content-encryption key and decrypt the captured content.
A response-discrepancy vulnerability in Bouncy Castle's CMS RSA PKCS#1 v1.5 key-transport unwrapping can expose whether submitted ciphertext has valid padding. If an attacker has a captured CMS EnvelopedData message and can send many modified messages to a decryption service that reveals distinguishable failures, they may recover the content-encryption key and decrypt the captured content.
Affected context
The issue affects applications using the Bouncy Castle C# CMS implementation for RSA PKCS#1 v1.5 key transport, particularly when the application decrypts attacker-influenced CMS messages with a recipient's RSA private key. Risk increases when decryption failures expose distinct exception messages, response behaviors, timing differences, or other observable signals, and when captured encrypted messages remain available for analysis.
The issue affects applications using the Bouncy Castle C# CMS implementation for RSA PKCS#1 v1.5 key transport, particularly when the application decrypts attacker-influenced CMS messages with a recipient's RSA private key. Risk increases when decryption failures expose distinct exception messages, response behaviors, timing differences, or other observable signals, and when captured encrypted messages remain available for analysis.
Exploit preconditions
- Attack surface: An application endpoint or service that accepts CMS EnvelopedData for RSA-based decryption
- Required access: Ability to submit many modified ciphertexts and observe the resulting decryption behavior
- Additional requirement: Access to a captured CMS message encrypted for the target recipient
- Trigger point: RSA PKCS#1 v1.5 key-transport unwrapping followed by content decryption
- Why exploitation is possible: Invalid padding produces a distinguishable failure during key unwrapping, while correctly padded values proceed to a later decryption stage, creating an adaptive padding oracle
- Attack surface: An application endpoint or service that accepts CMS EnvelopedData for RSA-based decryption
- Required access: Ability to submit many modified ciphertexts and observe the resulting decryption behavior
- Additional requirement: Access to a captured CMS message encrypted for the target recipient
- Trigger point: RSA PKCS#1 v1.5 key-transport unwrapping followed by content decryption
- Why exploitation is possible: Invalid padding produces a distinguishable failure during key unwrapping, while correctly padded values proceed to a later decryption stage, creating an adaptive padding oracle
Why this happens
The implementation preserves an observable distinction between invalid PKCS#1 v1.5 padding and ciphertexts that pass padding checks. Specifically, invalid padding causes a distinct CMS exception during key unwrapping instead of causing decryption to continue with a uniformly generated replacement key and a consistent external failure response.
This behavior maps to CWE-203: Observable Discrepancy, because security-relevant processing outcomes can be distinguished by an attacker. In an adaptive chosen-ciphertext attack, that discrepancy can function as a Bleichenbacher-style padding oracle.
The implementation preserves an observable distinction between invalid PKCS#1 v1.5 padding and ciphertexts that pass padding checks. Specifically, invalid padding causes a distinct CMS exception during key unwrapping instead of causing decryption to continue with a uniformly generated replacement key and a consistent external failure response.
This behavior maps to CWE-203: Observable Discrepancy, because security-relevant processing outcomes can be distinguished by an attacker. In an adaptive chosen-ciphertext attack, that discrepancy can function as a Bleichenbacher-style padding oracle.
Potential impact
- An attacker may recover the content-encryption key for a captured CMS message
- Encrypted CMS content could be decrypted without directly obtaining the recipient's RSA private key
- Confidential business data, credentials, or documents may be exposed
- Repeated probing could increase load on the decryption service
- Applications may suffer broader confidentiality loss if the same recipient key protects multiple messages
- An attacker may recover the content-encryption key for a captured CMS message
- Encrypted CMS content could be decrypted without directly obtaining the recipient's RSA private key
- Confidential business data, credentials, or documents may be exposed
- Repeated probing could increase load on the decryption service
- Applications may suffer broader confidentiality loss if the same recipient key protects multiple messages
General mitigation guidance
Mitigation generally focuses on removing decryption oracles and making failure behavior indistinguishable.
Common defensive patterns include:
- Use a maintained cryptographic implementation with protections against RSA PKCS#1 v1.5 padding-oracle attacks
- Prefer authenticated encryption and modern key-establishment schemes where protocol compatibility permits
- Normalize errors so padding, key-unwrapping, and content-decryption failures produce the same external result
- Avoid returning detailed cryptographic exception types, messages, or status codes to untrusted callers
- Apply consistent processing and response behavior to reduce timing and side-channel differences
- Limit repeated decryption attempts and enforce authorization, auditing, and rate controls
- Protect RSA private keys and use least-privilege isolation for decryption services
Mitigation generally focuses on removing decryption oracles and making failure behavior indistinguishable.
Common defensive patterns include:
- Use a maintained cryptographic implementation with protections against RSA PKCS#1 v1.5 padding-oracle attacks
- Prefer authenticated encryption and modern key-establishment schemes where protocol compatibility permits
- Normalize errors so padding, key-unwrapping, and content-decryption failures produce the same external result
- Avoid returning detailed cryptographic exception types, messages, or status codes to untrusted callers
- Apply consistent processing and response behavior to reduce timing and side-channel differences
- Limit repeated decryption attempts and enforce authorization, auditing, and rate controls
- Protect RSA private keys and use least-privilege isolation for decryption services
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and dependency review targeting RSA PKCS#1 v1.5 decryption and CMS key-transport paths
- Code review checks for externally visible distinctions between padding, key-unwrapping, and content-decryption failures
- Tests that submit malformed and correctly padded ciphertexts and compare status codes, response bodies, exception handling, and timing distributions
- Monitoring for repeated CMS decryption attempts involving related or systematically modified ciphertexts
- API policy enforcement that restricts who can submit encrypted messages and limits repeated failures
- Automated security review tools configured to flag padding-oracle patterns and detailed cryptographic error disclosure
Organizations can look for this class of issue through:
- Static analysis and dependency review targeting RSA PKCS#1 v1.5 decryption and CMS key-transport paths
- Code review checks for externally visible distinctions between padding, key-unwrapping, and content-decryption failures
- Tests that submit malformed and correctly padded ciphertexts and compare status codes, response bodies, exception handling, and timing distributions
- Monitoring for repeated CMS decryption attempts involving related or systematically modified ciphertexts
- API policy enforcement that restricts who can submit encrypted messages and limits repeated failures
- Automated security review tools configured to flag padding-oracle patterns and detailed cryptographic error disclosure
