CyberRota Analysis
AI-GeneratedThe vulnerability lies in the CMS RSA PKCS#1 v1.5 key-transport unwrap process in Legion of the Bouncy Castle Inc. bc-csharp versions prior to 2.7.0, where improper handling of invalid padding during decryption allows remote attackers to exploit this flaw through a Bleichenbacher-style adaptive chosen-ciphertext attack. This can lead to the recovery of the content-encryption key from captured CMS EnvelopedData messages, potentially exposing sensitive data. Organizations utilizing affected versions of this library should prioritize patching to mitigate the risk of data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an application that decrypts them with the recipient's RSA private key and reveals how decryption failed, to recover the captured message's content-encryption key and so its content, via a Bleichenbacher-style adaptive chosen-ciphertext attack, because a key-transport ciphertext with invalid PKCS#1 v1.5 padding is rejected during unwrap with a distinct "bad padding in message." CmsException instead of being replaced by a random key, so it can be told apart from a correctly padded ciphertext, which fails only later at content decryption.