CVE-2023-52323

Executive Summary

CVE-2023-52323 is a side-channel vulnerability in the PyCryptodome and pycryptodomex cryptographic libraries, affecting versions prior to 3.19.1. The flaw resides in the OAEP (Optimal Asymmetric Encryption Padding) decryption process, which leaks timing information exploitable for a Manger attack. This attack allows an adversary to recover the plaintext of RSA ciphertexts by observing the server's response time during decryption. The vulnerability has a CVSS score of 5.9 (Medium), with a high confidentiality impact but no integrity or availability impact. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is significant for systems handling sensitive encrypted data.

Supply Chain & Package Security

This vulnerability affects the PyCryptodome and pycryptodomex packages available on PyPI. Organizations using these libraries in their Python applications must verify their dependency versions and update to 3.19.1 or later. The supply chain risk is moderate, as the library is widely used for cryptographic operations in Python. Developers should audit their requirements.txt or Pipfile for affected versions and ensure automated builds pull the patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The attacker can exploit the vulnerability remotely.
• Attack Complexity: High (AC:H) – The attack requires precise timing measurements and multiple decryption attempts.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full plaintext recovery is possible.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The attack is complex but can lead to complete disclosure of encrypted data, making it critical for high-value targets.

Deep Dive & Mechanics

The Manger attack exploits the PKCS#1 OAEP decryption process by sending chosen ciphertexts to the server and measuring the response time. The vulnerability arises because the OAEP decryption in PyCryptodome does not perform constant-time operations when checking the padding validity. Specifically, the library leaks timing information through the following steps:

1. Ciphertext Submission: The attacker sends a modified RSA ciphertext to the server.
2. Decryption Attempt: The server decrypts the ciphertext and checks the OAEP padding.
3. Timing Leak: The server returns an error message or a different response time based on whether the padding is valid. The attacker measures this timing to deduce bits of the plaintext.
4. Iterative Recovery: By repeating this process with carefully crafted ciphertexts, the attacker can recover the entire plaintext.

The vulnerability is in the decrypt method of the OAEP cipher object, where the padding check is not constant-time. The fix in version 3.19.1 ensures that all padding checks take the same amount of time regardless of the input.

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.19.1):

# In OAEP decryption, the padding check is not constant-time
def decrypt(self, ciphertext):
    # ... decryption steps ...
    if not self._check_padding(em):
        raise ValueError("Incorrect decryption")
    # ... return plaintext ...

Patched Code (3.19.1+):

# Constant-time padding check
def decrypt(self, ciphertext):
    # ... decryption steps ...
    # Use constant-time comparison
    if not constant_time_compare(self._expected_padding, em):
        raise ValueError("Incorrect decryption")
    # ... return plaintext ...

The patched version uses a constant-time comparison function to prevent timing side-channels.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable version: pip install pycryptodome==3.18.0
2. Set up a simple server that decrypts RSA ciphertexts using OAEP.
3. Use a tool like manger-attack (available on GitHub) to perform the attack.

Exploitation Steps:

1. Capture a valid RSA ciphertext.
2. Send modified ciphertexts to the server and measure response times.
3. Use the Manger attack algorithm to recover the plaintext bit by bit.

Example Attack Script:

# Simplified Manger attack script
import socket
import time

def send_ciphertext(ciphertext):
    # Send ciphertext to server and measure response time
    start = time.time()
    # ... send and receive ...
    end = time.time()
    return end - start

# Iterate to recover plaintext
# ... (full implementation requires thousands of queries)

Blue Team

Detection:

• Monitor for unusual numbers of decryption requests to the same endpoint.
• Look for patterns of ciphertexts that are slightly modified from each other.
• Use network monitoring to detect timing-based attacks.

Mitigation:

• Immediately upgrade to pycryptodome 3.19.1 or later.
• Implement rate limiting on decryption endpoints.
• Add random delays to decryption responses to obscure timing.

Indicators of Compromise (IOCs)

• Network: Unusual traffic patterns with many decryption requests to the same service.
• Logs: Repeated "Incorrect decryption" errors in application logs.
• File: Presence of pycryptodome or pycryptodomex versions < 3.19.1 in Python environments.
• Behavior: High CPU usage on decryption endpoints due to repeated attack queries.

Detection Engineering

YARA Rule

rule CVE_2023_52323_PyCryptodome {
    meta:
        description = "Detects vulnerable PyCryptodome versions"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:example"
    strings:
        $vuln_version = /pycryptodome[_-]?[0-2]\.\d+\.\d+|3\.\d+\.\d+/
        $oaep_decrypt = "OAEP"
    condition:
        $vuln_version and $oaep_decrypt
}

Sigma Rule

title: CVE-2023-52323 Manger Attack Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential Manger attack attempts against PyCryptodome
logsource:
    category: application
    product: python
detection:
    selection:
        event: "Incorrect decryption"
        count: 100
    timeframe: 1m
    condition: selection
falsepositives:
    - Legitimate decryption errors
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2023-52323 Manger Attack Attempt"; flow:to_server; content:"|00 02|"; offset:0; depth:2; content:"|00|"; distance:1; within:256; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to pycryptodome or pycryptodomex version 3.19.1 or later.
2. Verification: Run pip show pycryptodome to check the installed version.
3. Code Review: Ensure all OAEP decryption uses the patched library.
4. Monitoring: Implement logging and alerting for repeated decryption errors.
5. Network: Use rate limiting and anomaly detection on decryption endpoints.
6. Long-term: Adopt constant-time cryptographic practices in all custom implementations.

Valters IT
Securing Digital Frontiers