Usage of CBC (Cipher Block Chaining) mode with padding

Rule ID: java_lang_padding_oracle_encryption_vulnerability
Languages: java
Source: padding_oracle_encryption_vulnerability.yml

Description

Using a block cipher algorithm mode, such as CBC (Cipher Block Chaining), together with a padding scheme is vulnerable to Padding Oracle attacks. This vulnerability arises because attackers can exploit the padding scheme to decrypt messages.

Remediations

Do not use CBC mode with padding for encryption. This combination is susceptible to security breaches.
```
Cipher c = Cipher.getInstance("AES/CBC/PKCS5Padding"); // unsafe
```
Do opt for GCM (Galois/Counter Mode) when implementing encryption. GCM is a more secure alternative that mitigates the risks associated with CBC mode.
```
Cipher c = Cipher.getInstance("AES/GCM/PKCS5Padding");
```

References

Associated CWE

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

OWASP Top 10

A02:2021 - Cryptographic Failures

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=java_lang_padding_oracle_encryption_vulnerability

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=java_lang_padding_oracle_encryption_vulnerability