CWE-780: Use of RSA Algorithm without OAEP

What is Use of RSA Algorithm without OAEP?

• Overview: This vulnerability involves using the RSA encryption algorithm without the Optimal Asymmetric Encryption Padding (OAEP) scheme, which can make the encryption weaker and less secure.

• Exploitation Methods:

• Attackers can exploit this vulnerability by performing chosen ciphertext attacks, which are easier when RSA is used without OAEP.
• Common attack patterns include exploiting the predictability of plaintexts to decrypt messages or perform unauthorized actions.

• Security Impact:

• Direct consequences include the potential for attackers to decrypt sensitive data that should be protected.
• Potential cascading effects include unauthorized access to information, leading to further security breaches.
• Business impact could involve data breaches, loss of customer trust, and potential legal liabilities.

• Prevention Guidelines:

• Specific code-level fixes involve implementing OAEP padding when using the RSA algorithm.
• Security best practices include keeping cryptographic libraries up to date and using established cryptographic protocols.
• Recommended tools and frameworks include using libraries that support OAEP, such as those provided in modern versions of OpenSSL or cryptography libraries in programming languages like Python, Java, and C#.

Corgea can automatically detect and fix Use of RSA Algorithm without OAEP in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Medium

Affected Languages: Not specified

Affected Technologies: Not specified