PT-2024-32459 · Unknown · Basic-Auth-Connect

Adamkorcz · Published 2024-09-30 · Updated 2024-11-15 · CVE-2024-47178

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions basic-auth-connect versions prior to 1.1.0

Description The issue concerns a timing-unsafe equality comparison in basic-auth-connect that can leak timing information. This comparison can potentially allow an attacker to observe differences in response times, which may lead to security issues. The problem has been fixed in version 1.1.0 of basic-auth-connect.

Recommendations For versions prior to 1.1.0, update to basic-auth-connect 1.1.0 to fix the timing information leak in Basic Auth middleware. As a temporary workaround, consider restricting access to the Basic Auth functionality until the update can be applied.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2024-47178

GHSA-7P89-P6HX-Q4FW

Affected Products

Basic-Auth-Connect

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47178.json · Exploit
• 🔥 https://github.com/expressjs/basic-auth-connect/security/advisories/GHSA-7p89-p6hx-q4fw · Exploit
• https://github.com/expressjs/basic-auth-connect/commit/bac1e6a8530e1efd0028800b9b588a37adb0d203 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-47178 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47178 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7p89-p6hx-q4fw · Vendor Advisory
• https://github.com/expressjs/basic-auth-connect · Note
• https://twitter.com/CveFindCom/status/1840776382604812701 · Twitter Post
• https://twitter.com/kom_256/status/1840702304879522175 · Twitter Post
• https://t.me/latest_high_impact_cve/1236 · Telegram Post
• https://t.me/cvedetector/6664 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1840840474115928518 · Twitter Post
• https://twitter.com/CVEnew/status/1840773020836602071 · Twitter Post
• https://twitter.com/UndercodeNews/status/1857565079413346492 · Twitter Post
• https://twitter.com/oktsec/status/1840808360834224577 · Twitter Post