Poodle Attack in Actix with Bearer Tokens

A Poodle (Padding Oracle On Downgraded Legacy Encryption) attack targets systems that negotiate TLS with older, insecure options such as SSLv3. When an Actix web service is configured to support SSLv3 alongside stronger protocols, an attacker who can intercept or downgrade traffic may use a padding oracle to decrypt captured ciphertext, including session tokens. If the service uses Bearer Tokens in HTTP Authorization headers, those tokens can be recovered piece by piece by iteratively observing error differences between padding failures and valid decryption results.

In an Actix-based API, a typical risk pattern is allowing TLS negotiation that includes SSLv3 or not enforcing strong cipher suites. Even when Bearer Tokens are transmitted over what appears to be HTTPS, a server-side implementation that accepts SSLv3 makes the channel vulnerable to Poodle. The attack does not exploit Actix itself, but the runtime configuration and protocol choices around the Actix service. An attacker can force or exploit a downgrade to SSLv3 and then use crafted requests to learn about the padding structure of encrypted requests that carry Authorization: Bearer headers. Because the token is simply a string inside the Authorization header, if the ciphertext of that request is captured and the service processes it under SSLv3, iterative decryption can reveal the token value.

The combination is particularly dangerous because Bearer Tokens are often long-lived and used across multiple services. If an attacker recovers a token, they can impersonate the client until the token is rotated. Actix applications that rely on middleware or custom guards to validate tokens may not detect the downgrade because the decryption happens at the transport layer before application-level checks. Therefore, the vulnerability is a result of both protocol misconfiguration and the high-value nature of Bearer Tokens in the authorization flow.

Remediation focuses on preventing SSLv3 negotiation and enforcing modern TLS configurations so that Poodle cannot be exploited. You should disable SSLv3 explicitly and restrict cipher suites to those that do not permit weak encryption. For Actix web services, this is typically done at the Rust/TLS layer (e.g., using native-tls or rustls) rather than in Actix itself. Below are concrete examples that show how to configure an Actix server with secure TLS settings and how to validate Bearer Tokens in a way that does not depend on transport-layer safety alone.

First, ensure your TLS configuration disables SSLv3 and prefers strong ciphers. Using rustls as an example:

use actix_web::{web, App, HttpServer, Responder};
use actix_web::http::header::HeaderValue;
use actix_web::dev::ServiceRequest;
use actix_web::middleware::Next;
use actix_web::error::ErrorUnauthorized;
use std::sync::Arc;
use rustls::{ServerConfig, CipherSuite, ProtocolVersion};
use rustls::pki_types::{CertificateDer, PrivateKeyDer};

async fn validate_bearer(req: ServiceRequest, next: Next) -> Result {
    let auth_header = req.headers().get("Authorization");
    match auth_header {
        Some(header_value) => {
            let header_str = header_value.to_str().unwrap_or("");
            if header_str.starts_with("Bearer ") {
                let token = &header_str[7..];
                if token == "your-secure-token-here" {
                    return Ok(req.call_next(next).await?);
                }
            }
            Err(ErrorUnauthorized("Invalid or missing Bearer Token"))
        }
        None => Err(ErrorUnauthorized("Missing Authorization header")),
    }
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    let certs = rustls_pemfile::certs(&mut std::io::BufReader::new(std::fs::File::open("cert.pem").unwrap())).unwrap();
    let key = rustls_pemfile::pkcs8_private_keys(&mut std::io::BufReader::new(std::fs::File::open("key.pem").unwrap())).unwrap();
    let mut config = ServerConfig::builder()
        .with_safe_defaults()
        .with_no_client_auth()
        .with_single_cert(
            certs.into_iter().map(CertificateDer::from).collect(),
            PrivateKeyDer::Pkcs8(key[0].clone().into()),
        )
        .map_err(|err| -> std::io::Error { std::io::Error::new(std::io::ErrorKind::InvalidInput, err) })?;

    // Explicitly disable SSLv3 if the library exposes options; rustls does not support SSLv3 at all.
    config.versions = vec![rustls::ProtocolVersion::TLSv1_2, rustls::ProtocolVersion::TLSv1_3];

    HttpServer::new(move || {
        App::new()
            .wrap_fn(|req, next| validate_bearer(req, next))
            .route("/secure", web::get().to(|| async { "secure data" }))
    })
    .bind_rustls("127.0.0.1:8443", config)?
    .run()
    .await
}

This example binds an Actix server to TLS with only TLS 1.2 and 1.3, ensuring SSLv3 is not available. It also demonstrates Bearer Token validation in application code. Note that TLS configuration is handled via rustls; consult the documentation of your chosen TLS backend to disable legacy protocols and weak ciphers.

Additionally, always use HTTPS in production and set the Authorization header exactly as shown. Do not rely on the absence of SSLv3 alone; rotate Bearer Tokens regularly and scope them to minimize impact if a token is ever compromised.