PT-2023-23965 · Gost · Gost

Ginuerzh · Published 2023-05-22 · Updated 2023-06-05 · CVE-2023-32691

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions gost (GO Simple Tunnel) (affected versions not specified)

Description The issue arises from the comparison of untrusted input, sourced from an HTTP header, with a secret using a non-constant time comparison function. This allows an attacker to mount a side-channel timing attack to guess the password. Sensitive secrets such as passwords, token, and API keys should be compared only using a constant-time comparison function.

Recommendations As a temporary workaround, consider using a constant time comparing function such as crypto/subtle's ConstantTimeCompare to compare sensitive secrets. Apply the provided patch to fix the timing attack vulnerability in the auth.go file. Use the ConstantTimeCompare function from the crypto/subtle package to securely compare passwords, as shown in the example fix. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2023-32691

GHSA-QJRQ-HM79-49WW

Affected Products

Gost

References · 7

• 🔥 https://github.com/ginuerzh/gost/security/advisories/GHSA-qjrq-hm79-49ww · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32691.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-32691 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32691 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qjrq-hm79-49ww · Vendor Advisory
• https://github.com/ginuerzh/gost/blob/1c62376e0880e4094bd3731e06bd4f7842638f6a/auth.go#L46 · Note
• https://github.com/ginuerzh/gost · Note