✍️ Description

The method encryptsensitiveinformation() in BaseClient.php uses the RSA algorithm without OAEP padding, thereby making the encryption weak.

In order to use RSA securely, the OAEP padding mode (Optimal Asymmetric Encryption Padding) must be used.

This category was derived from the Cigital Java Rulepack. http://www.cigital.com/

🕵️‍♂️ Proof of Concept

//The following code uses RSA encryption algorithm without appropriate padding
    protected function encryptSensitiveInformation(string $string)
    {
        $certificates = $this->app['config']->get('certificate');
        if (null === $certificates) {
            throw new InvalidArgumentException('config certificate connot be empty.');
        }

        $encrypted = '';
        $publicKeyResource = openssl_get_publickey($certificates);
        $f = openssl_public_encrypt($string, $encrypted, $publicKeyResource);
        openssl_free_key($publicKeyResource);
        if ($f) {
            return base64_encode($encrypted);
        }

💥 Impact

When used in practice, RSA is generally combined with some padding scheme. The goal of the padding scheme is to prevent a number of attacks that potentially work against RSA without padding.