CVE-2022-31142

Potential Timing Attack Vector in @fastify/bearer-auth

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack. Version 7.0.2 and 8.0.1 of @fastify/bearer-auth contain a patch. There are currently no known workarounds. The package fastify-bearer-auth, which covers versions 6.0.3 and prior, is also vulnerable starting at version 5.0.1. Users of fastify-bearer-auth should upgrade to a patched version of @fastify/bearer-auth.

fastify/bearer-auth es un plugin de Fastify para requerir encabezados de autorización de portador. fastify/bearer-auth versiones anteriores a 7.0.2 y 8.0.1, no usa de forma segura crypto.timingSafeEqual. Un atacante malicioso podría estimar la longitud de un token de portador válido. Según el correspondiente RFC 6750, el token de portador sólo presenta caracteres válidos en base64, reduciendo el rango de caracteres para un ataque de fuerza bruta. Las versiones 7.0.2 y 8.0.1 de fastify/bearer-auth contienen un parche. Actualmente no se presentan mitigaciones conocidas. El paquete fastify-bearer-auth, que cubre las versiones 6.0.3 y anteriores, también es vulnerable a partir de la versión 5.0.1. Los usuarios de fastify-bearer-auth deberían actualizar a una versión parcheada de fastify/bearer-auth

*Credits: N/A

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-05-18 CVE Reserved
2022-07-14 CVE Published
2024-02-04 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-203: Observable Discrepancy
CWE-208: Observable Timing Discrepancy

CAPEC

References (4)

URL	Tag	Source
https://github.com/fastify/fastify-bearer-auth/security/advisories/GHSA-376v-xgjx-7mfr	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/fastify/fastify-bearer-auth/commit/0c468a616d7e56126dc468150f6a5a92e530b8e4	2022-07-20
https://github.com/fastify/fastify-bearer-auth/commit/39353b15409ee99474545f615ffb16180cf3b716	2022-07-20
https://github.com/fastify/fastify-bearer-auth/commit/f921a0582dc83112039004a9b5041141b50c5b3f	2022-07-20

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Fastify Search vendor "Fastify"		Bearer-auth Search vendor "Fastify" for product "Bearer-auth"				>= 5.0.1 < 7.0.2 Search vendor "Fastify" for product "Bearer-auth" and version " >= 5.0.1 < 7.0.2"		node.js		Affected
Fastify Search vendor "Fastify"		Bearer-auth Search vendor "Fastify" for product "Bearer-auth"				8.0.0 Search vendor "Fastify" for product "Bearer-auth" and version "8.0.0"		node.js		Affected