PT-2024-35168 · Authentik · Authentik
Mgerstner
·
Published
2024-11-21
·
Updated
2026-04-16
·
CVE-2024-52307
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
authentik versions prior to 2024.8.5
authentik version 2024.10.3
Description
The issue is related to the usage of a non-constant time comparison for the "/-/metrics/" endpoint, which made it possible to brute-force the
SECRET KEY used to authenticate the endpoint. This endpoint returns Prometheus metrics and is not intended to be accessed directly. It is meant to be accessed by the Go proxy running in the authentik server container, which serves the data on a separate port. Since the endpoint is not intended to be accessed publicly, requests to it can be blocked by the reverse proxy/load balancer used with authentik.Recommendations
For versions prior to 2024.8.5, update to version 2024.8.5 or later to fix the issue.
For version 2024.10.3, this version fixes the issue, so no further action is required for this specific version.
As a temporary workaround, consider blocking requests to the "/-/metrics/" endpoint by configuring the reverse proxy/load balancer to minimize the risk of exploitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Authentik