There is a bug in Base32 implementation in Apache Commons Codecs:

Example, there is no byte array value that can be encoded into the string "C5CYMIHWQUUZMKUGZHGEOSJSQDE4L===", but the existing Base32 implementation would not reject it but decode it into an arbitrary value which if re-encoded again using the same implementation would result in the string "C5CYMIHWQUUZMKUGZHGEOSJSQDE4K===".

Instead of blindly decoding the invalid string, the Base32 codec should reject it (eg by throwing IlleglArgumentException) to avoid security exploitation (such as tunneling additional information via seemingly valid base 32 strings).

What I do not understand is how can an attacker use this bug to tunnel additional information. The attacker sends invalid base32 string and obtains a slightly different base32 string back. What harm can it cause?


"such as tunneling additional information via seemingly valid base 32 strings"

This is the security concern expressed by whoever reported that bug. It is often called a covert channel. Covert channels are ways to exfiltrate information out of a security zone without being detected.

In all generality, covert channels are rarely an issue because:

  1. They can be exploited in situations where the attacker is already inside the security zone, at which point most of security has already gone down the drain.

  2. Tracking all possibilities of covert channels is an endless task. Most communication protocols allow for some variation that can be turned into covert channels. The bug in the Base32 decoder is just one more such way, but it would be overly optimistic to believe that this is the only one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.