Poodle Attack in Adonisjs with Basic Auth

The Poodle attack (CVE-2014-3566) exploits weak legacy encryption in TLS by forcing a downgrade to SSL 3.0 and exploiting its CBC padding oracle. AdonisJS applications that terminate TLS at a proxy/load balancer and then forward traffic over plain HTTP to the Node.js server can inadvertently create conditions where an SSL/TLS downgrade is possible if the client negotiates SSL 3.0. When Basic Auth credentials are passed in cleartext over that downgraded connection, they are trivially recoverable.

In this combination, the risk arises because:

• AdonisJS may serve behind an ingress that handles SSL termination; if the backend channel is not enforced to use strong TLS, an attacker on-path can negotiate SSL 3.0 with the client or the proxy, making the transport of Basic Auth credentials vulnerable to decryption and tampering.
• Basic Auth encodes credentials in Base64 without encryption; if SSL 3.0 is used, confidentiality is compromised, allowing session hijacking or credential theft.
• AdonisJS itself does not introduce the protocol weakness, but configurations that allow SSL 3.0 or do not enforce modern TLS versions on the edge enable Poodle when Basic Auth is used for authentication.

middleBrick’s unauthenticated scan checks for TLS configuration weaknesses and insecure credential transport. In one scan, a target exposing Basic Auth over a channel that permits SSL 3.0 would receive findings for Data Exposure and Encryption, alongside a recommendation to enforce TLS 1.2+ and remove cleartext authentication mechanisms.

An example of vulnerable AdonisJS route handling Basic Auth without transport safeguards:

// routes.ts
import Route from '@ioc:Adonis/Core/Route'

Route.get('/profile', (ctx) => {
  const auth = ctx.request.authorization
  if (!auth || !auth.username || !auth.password) {
    ctx.response.status(401).send({ error: 'Basic Auth required' })
    return
  }
  // Insecure: credentials handled over potentially weak TLS if SSL 3.0 is allowed
  ctx.response.send({ user: auth.username })
})

An attacker conducting a Poodle-style downgrade would intercept this Basic Auth exchange, recover credentials, and exploit the weak cipher suites. middleBrick’s checks for Encryption and Data Exposure highlight such endpoints when the runtime permits SSL 3.0 or weak ciphers.

Remediation focuses on preventing SSL 3.0 usage and ensuring credentials are never transmitted in cleartext. Enforce modern TLS on your edge/proxy and avoid Basic Auth over non-HTTPS channels. If you must use Basic Auth, always do so over TLS 1.2+ and prefer token-based mechanisms where possible.

1. Enforce strong TLS versions on your reverse proxy/load balancer (example configurations are environment-specific; below is a Node HTTPS server example to illustrate strict settings):

// server.ts
import { createServer } = require('https')
import { readFileSync } = require('fs')
import { Application } from '@adonisjs/core/build/standalone'

const app = new Application()
// Configure secure ciphers and disable SSL 3.0
const server = createServer({
  key: readFileSync('/path/to/privkey.pem'),
  cert: readFileSync('/path/to/cert.pem'),
  ciphers: [
    'TLS_AES_256_GCM_SHA384',
    'TLS_CHACHA20_POLY1305_SHA256',
    'TLS_AES_128_GCM_SHA256'
  ].join(':'),
  honorCipherOrder: true,
  secureOptions: require('constants').SSL_OP_NO_SSLv3 | require('constants').SSL_OP_NO_TLSv1 | require('constants').SSL_OP_NO_TLSv1_1
}).listen(443, () => {
  console.log('Secure server listening on 443')
})

2. In AdonisJS routes, avoid processing Basic Auth unless the request is secured. Instead, use AdonisJS auth providers (e.g., Basic Auth via AdonisJS auth providers) which integrate with TLS enforcement:

// start/kernel.ts
import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export const middleware = [
  'verifyCsrfToken',
  'validateAdonisAddons',
  'blockSuspiciousRequests'
]

// routes.ts with enforced HTTPS and proper auth handling
import Route from '@ioc:Adonis/Core/Route'

Route.group(() => {
  Route.get('/profile', async ({ request, response }: HttpContextContract) => {
    // Ensure TLS is enforced upstream; reject if not secure
    if (!request.secure()) {
      return response.forbidden({ error: 'HTTPS required' })
    }
    const auth = request.authorization
    if (!auth || !auth.username || !auth.password) {
      return response.unauthorized({ error: 'Provide Basic Auth credentials' })
    }
    // Validate credentials against your user store securely
    const valid = await verifyBasicAuthCredentials(auth.username, auth.password)
    if (!valid) {
      return response.unauthorized({ error: 'Invalid credentials' })
    }
    return response.ok({ user: auth.username })
  }).middleware(['https'])
})

3. Prefer token-based authentication (e.g., JWT) over Basic Auth. If you must keep Basic Auth, ensure credentials are only sent over TLS-terminated connections and are never logged or cached.