# Exploiting unauthenticated encryption mode

ownCloud's encryption module used AES-CFB without authentication, letting an untrusted storage admin bit-flip ciphertext to backdoor EXE files with injected code.

- Payout: $350
- Severity: medium
- Program: ownCloud
- Credited: hanno
- Disclosed: 2016-04-04
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/108082
- Library page: https://bugbountylibrary.com/r/h1%3A108082
- Tags: domain:web impact:integrity impact:rce kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:crypto

**Target:** ownCloud file encryption module (AES-CFB) on untrusted external storage
**Root cause:** File contents encrypted with AES in CFB mode without any authentication/MAC, so ciphertext is malleable and tampering is undetectable.
**Steps:**
1. Upload a known EXE (e.g. putty.exe) to an ownCloud instance with encryption enabled on untrusted storage
2. Flip a single bit in the third ciphertext block so the fourth block becomes garbage, invalidating the PE header and forcing Windows to run the DOS stub
3. XOR attacker code over the predictable DOS stub region to backdoor the executable
4. Run `make` in pwncloud dir then `pwncloud [file]` to produce the tampered EXE that prints 'PWN'
**How found:** Recognized that CFB mode permits bitwise ciphertext manipulation and that EXE files have a highly predictable DOS stub, so corrupting the PE header forces execution of the controllable DOS portion.
**Exploitation:** A malicious storage administrator with ciphertext access identifies EXE files by their visible filenames, bit-flips block 3 to corrupt the PE header so Windows falls back to the DOS stub, then XORs attacker code over the known DOS stub to gain ~16 bytes of code execution, extendable by chaining more manipulated blocks.
**Escalation:** 16 bytes of code execution can be extended by manipulating additional blocks and jumping to them; same technique applies to other known-format files like zip/tarballs.
**Insight:** When encryption lacks authentication, look for file formats with predictable/known plaintext regions (PE DOS stubs, zip headers) where a bit-flip can redirect execution to attacker-controlled bytes.