# Cross-protocol attack on TLS using SSLv2 (DROWN) (CVE-2016-0800)

SSLv2 EXPORT ciphers on servers sharing RSA keys with TLS servers act as a Bleichenbacher padding oracle, letting attackers decrypt TLS session keys.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: nimia
- Disclosed: 2016-09-21
- CVE: CVE-2016-0800
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/166629
- Library page: https://bugbountylibrary.com/r/h1%3A166629
- Tags: area:cloud domain:infra impact:data-leak kind:bounty platform:hackerone sev:high technique:chained vuln:crypto vuln:oracle-manipulation

**Target:** TLS/SSL server supporting SSLv2 EXPORT cipher suites
**Root cause:** SSLv2 EXPORT cipher handshakes leak RSA padding validity, forming a Bleichenbacher oracle; when the same RSA key is used by a TLS server, that oracle can be used cross-protocol to recover TLS session keys.
**Steps:**
1. Identify a server supporting SSLv2 with EXPORT cipher suites whose RSA key is shared with a TLS endpoint.
2. Send crafted SSLv2 handshake messages to the SSLv2 server to probe RSA padding validity (Bleichenbacher oracle).
3. Use oracle responses to iteratively recover the TLS pre-master/session key (~2^50 work, thousands of connections).
4. Decrypt captured TLS traffic using the recovered session key.
**Exploitation:** Attacker captures TLS traffic, then queries a co-keyed SSLv2/EXPORT server as a padding oracle across thousands of connections to recover the session key and decrypt the recorded sessions.
**Escalation:** Efficiency improves dramatically against unpatched OpenSSL predating 1.0.2a/1.0.1m/1.0.0r/0.9.8zf (CVE-2016-0703); servers patched for CVE-2015-3197 but with SSLv2 enabled can still be forced into EXPORT ciphers.
**Insight:** Shared RSA keys across protocol endpoints (SMTP/IMAP/POP vs HTTPS) extend an oracle's reach: a weak legacy service can break a modern one if they share a key, so check key reuse across all SSLv2/EXPORT-capable listeners.