search

stripe / stripe-react-native

React Native library for Stripe.
https://stripe.dev/stripe-react-native
MIT License
1.27k stars 265 forks source link

Insecure encryption mode CBC with PKCS7 in nimbus-jose-jwt #1432

Closed Rananjaya closed 1 year ago

Rananjaya commented 1 year ago

We got a security vulnerability from our pentest team, “The application uses insecure encryption mode CBC with PKCS7 padding, an insecure and deprecated algorithm.” And it is related to com.nimbusds:nimbus-jose-jwt maven package which is a dependancy of com.stripe:stripe-3ds2-android package.

Included files:

com.ourappidentifier/com/nimbusds/jose/crypto/impl/AESCBC.java

com.ourappidentifier/com/nimbusds/jose/jca/JCASupport.java

Pentest Team Recommendations:

During the testing we observed that the application uses deprecated encryption mode CBC with PKCS5/PKCS7 padding. This type of configuration is vulnerable to padding oracle attack. Verify that cryptographic algorithms are up to date and in-line with industry standards. https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficientcryptography

This is the dependancy tree:

project :stripe_stripe-react-native

+--- com.stripe:stripe-android:20.9.+ -> 20.9.0

    +--- com.stripe:payments-core:20.9.0

            +--- com.stripe:stripe-core:20.9.0

                    +--- com.stripe:stripe-3ds2-android:6.1.5

                            +--- com.nimbusds:nimbus-jose-jwt:9.21
MicrosoftTeams-image (1)
davidme-stripe commented 1 year ago

Hello @Rananjaya, thanks for flagging this.

The EMVCo 3-D Secure Standard recommends the use of AES in CBC mode with PKCS #7 padding when encrypting certain data, including 3DS2 transaction IDs and redacted device information. The consumer's device sends this encrypted data to Stripe over a TLS connection using the best available cipher suite: We do not rely on A128CBC-HS256 to secure communication between our SDK and the Stripe API.

Stripe continually reviews cryptography algorithm usage to ensure we meet industry standards, maintain compatibility with third parties, and protect our users.

Hope this helps!

jameswoo-stripe commented 1 year ago

See this changelog as well.