07. A Quick Feel for AES-CBC Bit-Flipping Attacks

In CBC mode, the preceding ciphertext block is XORed into the plaintext of the next block. This allows an attacker to flip specific bits in C_{i-1} and change P_i into a desired form. If the server trusts the decrypted result as-is and parses a string such as role=user, it can be modified to escalate the role to role=admin.

Why it is dangerous

• CBC provides no integrity guarantee
• Distinct error messages may lead to an oracle
• It is critical when a token or cookie contains "user permissions"

Simple practical flow

1. Calculate the target string position (align it to a block boundary)
2. delta = desired ^ original
3. XOR the delta into C_{i-1} → P_i changes to the desired value

Defense points

• Use Encrypt-then-MAC or AEAD (GCM/ChaCha20-Poly1305)
• Verify the MAC before parsing after decryption
• Make error messages and timing uniform

It is common in CTFs, but "legacy CBC cookies" still sometimes survive in production. When one is found, replace it immediately.