PT-2022-20560 · Fastify · @Fastify/Bearer-Auth

Uzlopak · Published 2022-07-14 · Updated 2022-07-20 · CVE-2022-31142

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions @fastify/bearer-auth versions prior to 7.0.2 and 8.0.1 fastify-bearer-auth versions 5.0.1 through 6.0.3

Description The issue is related to the insecure use of crypto.timingSafeEqual in @fastify/bearer-auth, allowing a malicious attacker to estimate the length of one valid bearer token. According to RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack.

Recommendations For @fastify/bearer-auth versions prior to 7.0.2, upgrade to version 7.0.2 or later. For @fastify/bearer-auth versions prior to 8.0.1, upgrade to version 8.0.1 or later. For fastify-bearer-auth versions 5.0.1 through 6.0.3, upgrade to a patched version of @fastify/bearer-auth.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

CVE-2022-31142

GHSA-376V-XGJX-7MFR

Affected Products

@Fastify/Bearer-Auth

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31142.json · Exploit
• https://github.com/fastify/fastify-bearer-auth/commit/f921a0582dc83112039004a9b5041141b50c5b3f · Patch
• https://github.com/fastify/fastify-bearer-auth/commit/0c468a616d7e56126dc468150f6a5a92e530b8e4 · Patch
• https://github.com/fastify/fastify-bearer-auth/commit/39353b15409ee99474545f615ffb16180cf3b716 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31142 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31142 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-376v-xgjx-7mfr · Vendor Advisory
• https://github.com/fastify/fastify-bearer-auth/security/advisories/GHSA-376v-xgjx-7mfr · Note
• https://github.com/fastify/fastify-bearer-auth · Note
• https://t.me/cibsecurity/46271 · Telegram Post
• https://t.me/cvenotify/33465 · Telegram Post
• https://hackerone.com/reports/1633287 · Note