{"record":{"id":"92a24386f24920df","repo":"shadow1ng/fscan","slug":"oracle-authentication-protocol-internal-error","errorCode":null,"errorMessage":"oracle authentication protocol internal error","messagePattern":"oracle authentication protocol internal error","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":1308,"sourceCode":"\t\t\tfor i := 0; i < dictLen; i++ {\n\t\t\t\tkey, val, num, err := s.getKeyVal()\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, err\n\t\t\t\t}\n\t\t\t\tswitch string(key) {\n\t\t\t\tcase \"AUTH_SESSKEY\":\n\t\t\t\t\tif auth.eServerSessKey == \"\" {\n\t\t\t\t\t\tauth.eServerSessKey = string(val)\n\t\t\t\t\t}\n\t\t\t\tcase \"AUTH_VFR_DATA\":\n\t\t\t\t\tif auth.salt == \"\" {\n\t\t\t\t\t\tauth.salt = string(val)\n\t\t\t\t\t\tauth.verifierType = num\n\t\t\t\t\t}\n\t\t\t\tcase \"AUTH_PBKDF2_CSK_SALT\":\n\t\t\t\t\tauth.pbkdf2ChkSalt = string(val)\n\t\t\t\t\tif len(auth.pbkdf2ChkSalt) != 32 {\n\t\t\t\t\t\treturn nil, errors.New(\"oracle authentication protocol internal error\")\n\t\t\t\t\t}\n\t\t\t\tcase \"AUTH_PBKDF2_VGEN_COUNT\":\n\t\t\t\t\tauth.pbkdf2VgenCount, _ = strconv.Atoi(string(val))\n\t\t\t\t\tif auth.pbkdf2VgenCount < 4096 || auth.pbkdf2VgenCount > 100000000 {\n\t\t\t\t\t\tauth.pbkdf2VgenCount = 4096\n\t\t\t\t\t}\n\t\t\t\tcase \"AUTH_PBKDF2_SDER_COUNT\":\n\t\t\t\t\tauth.pbkdf2SderCount, _ = strconv.Atoi(string(val))\n\t\t\t\t\tif auth.pbkdf2SderCount < 3 || auth.pbkdf2SderCount > 100000000 {\n\t\t\t\t\t\tauth.pbkdf2SderCount = 3\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\tdefault:\n\t\t\terr := s.readMsg(msg)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}","sourceCodeStart":1290,"sourceCodeEnd":1326,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L1290-L1326","documentation":"When the server uses PBKDF2-based (O5LOGON variant) authentication, it supplies AUTH_PBKDF2_CSK_SALT, which must be exactly 32 bytes (base64/encoding aside, the decoded value length is validated). Any other length means the server's authentication response is malformed for this protocol and the client refuses to derive keys from it.","triggerScenarios":"Parsing the auth response during oracleRawAuth: the AUTH_PBKDF2_CSK_SALT key/value pair decodes to a string/value whose length is not 32.","commonSituations":"Oracle server version emitting a different PBKDF2 salt length than the plugin expects; authentication plugins/extensions (e.g. CMU, third-party auth adapters) altering the salt; encoding/padding mishandling in the value.","solutions":["Check server version/patch level against versions the plugin supports; upgrade the plugin if your server is newer","If using Advanced Authentication / CMU or third-party auth adapters, test with standard password-based auth to isolate the mismatch","Log the actual salt length and value to confirm decoding is correct, then report an upstream issue if the server legitimately differs","Verify AUTH_PBKDF2_VGEN_COUNT and related params in the same response for overall consistency"],"exampleFix":"// before\nauth.pbkdf2ChkSalt = string(val)\nif len(auth.pbkdf2ChkSalt) != 32 {\n\treturn nil, errors.New(\"oracle authentication protocol internal error\")\n}\n// after\nauth.pbkdf2ChkSalt = string(val)\nif len(auth.pbkdf2ChkSalt) != 32 {\n\treturn nil, fmt.Errorf(\"oracle authentication protocol internal error: salt length %d, want 32\", len(auth.pbkdf2ChkSalt))\n}","handlingStrategy":"type-guard","validationCode":"// inspect auth params before finish(): log salt length during diagnosis\nfor k, v := range authParams {\n\tif k == \"AUTH_PBKDF2_CSK_SALT\" {\n\t\tlog.Printf(\"pbkdf2 salt len=%d\", len(v))\n\t}\n}","typeGuard":"func validPbkdf2Salt(s string) bool { return len(s) == 32 }","tryCatchPattern":"auth, err := parseAuthResponse(resp)\nif err != nil && strings.Contains(err.Error(), \"authentication protocol internal error\") {\n\treturn fmt.Errorf(\"PBKDF2 salt length unexpected; check server version/auth adapter compatibility: %w\", err)\n}","preventionTips":["Verify server version supports PBKDF2 auth as the plugin expects","Test with standard password auth to rule out CMU/third-party auth adapters","Log raw AUTH_PBKDF2_* values when diagnosing"],"tags":["oracle","authentication","pbkdf2","protocol"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}