Poodle Attack in Adonisjs with Mutual Tls

The Poodle attack (Padding Oracle On Downgraded Legacy Encryption) targets systems that negotiate TLS with SSLv3. Even when mutual TLS (mTLS) is used for strong client authentication, protocol downgrade or legacy endpoint support can reintroduce the vulnerability. In Adonisjs applications that accept TLS connections, mTLS ensures both client and server present certificates. However, if the server or an upstream proxy still enables SSLv3 or allows fallback to it, an attacker who can observe and modify traffic may force a session to use SSLv3. Because SSLv3 lacks secure protections against padding oracle attacks, an attacker can iteratively submit modified ciphertext and learn plaintext by observing whether padding validation succeeds or fails, even when client certificates are required.

With mTLS in Adonisjs, the server validates client certificates before establishing the application session. This is effective against many threats, but does not protect against a protocol downgrade that weakens encryption to SSLv3. For example, if the TLS stack or load balancer negotiates SSLv3 despite the server offering stronger ciphers, the confidentiality and integrity guarantees of TLS are undermined. Adonisjs relies on the underlying Node.js TLS module; if Node.js is configured to support SSLv3 (or accepts legacy cipher suites that include it), the server may inadvertently accept SSLv3 handshakes. In such a configuration, mTLS authenticates the client, but the encrypted channel itself becomes exploitable via a padding oracle, allowing decryption of sensitive request bodies or cookies.

An attacker might also target an mTLS-enabled Adonisjs API by presenting a valid client certificate while forcing SSLv3 on the connection. This can occur when backend services or reverse proxies have inconsistent TLS policies, permitting older protocols for certain clients or paths. Because SSLv3 does not provide reliable message integrity outside its MAC, an attacker can use a padding oracle to decrypt data or inject malicious content. The presence of client certificates does not mitigate this; the vulnerability is in the protocol choice and cipher suite negotiation, not in certificate validation. Therefore, ensuring that Adonisjs deployments disable SSLv3 and avoid offering or accepting legacy cipher suites is essential to prevent Poodle attacks in mTLS environments.

To securely use mutual TLS in Adonisjs while preventing Poodle attacks, explicitly disable SSLv3 and restrict cipher suites to modern, secure options. Configure the HTTPS server via the tls section in start/hooks.ts or the underlying Node.js TLS options used by your Adonisjs server. Below is a concrete example of server-side mTLS configuration that disables SSLv3 and prioritizes strong ciphers.

import { Application } from '@adonisjs/core/types'
import { createServer } from 'node:https'
import { readFileSync } from 'node:fs'

export default (app: Application) => {
  const tlsOptions = {
    key: readFileSync('path/to/server-key.pem'),
    cert: readFileSync('path/to/server-cert.pem'),
    ca: readFileSync('path/to/ca-chain.pem'), // trusted CAs for client verification
    requestCert: true,
    rejectUnauthorized: true,
    minVersion: 'TLSv1.2',
    maxVersion: 'TLSv1.3',
    ciphers: [
      'TLS_AES_256_GCM_SHA384',
      'TLS_CHACHA20_POLY1305_SHA256',
      'TLS_AES_128_GCM_SHA256',
    ].join(':'),
    // Explicitly exclude SSLv3 and weak ciphers
    secureOptions: 0,
  }

  const server = createServer(tlsOptions, app.callback())
  server.listen(app.config.get('https.port', 8443))
}

For client-side mTLS when Adonisjs calls external APIs, enforce similar restrictions. The HTTP client used by Adonisjs (such as native fetch or a library like axios with an https agent) should disable SSLv3 and specify secure ciphers. Below is an example using Node.js https agent options to enforce modern TLS and require client certificates.

import { Agent } = require('node:https')

const tlsAgent = new Agent({
  cert: readFileSync('path/to/client-cert.pem'),
  key: readFileSync('path/to/client-key.pem'),
  ca: readFileSync('path/to/ca-chain.pem'),
  minVersion: 'TLSv1.2',
  maxVersion: 'TLSv1.3',
  ciphers: [
    'TLS_AES_256_GCM_SHA384',
    'TLS_CHACHA20_POLY1305_SHA256',
    'TLS_AES_128_GCM_SHA256',
  ].join(':'),
  rejectUnauthorized: true,
})

// Example usage with a fetch-like client that accepts an agent
// fetch('https://api.example.com/endpoint', { agent: tlsAgent })

Additionally, audit any reverse proxy or load balancer in front of Adonisjs to ensure they do not permit SSLv3 or accept legacy cipher suites. Use tools that validate TLS configurations and confirm that protocol negotiation never falls back to SSLv3. These steps ensure that mutual TLS in Adonisjs provides both strong authentication and robust encryption, effectively mitigating Poodle attacks.