Executive brief
Fastify Bearer Auth is a security plugin used to protect web applications by requiring a specific authorization token. A vulnerability in how the plugin compares these tokens allows an attacker to measure the time it takes for the server to respond, potentially revealing the correct length and content of a valid token. This could allow an unauthorized user to bypass security controls and gain access to protected data or services.
Technical details
The fastify-bearer-auth plugin (and its scoped version @fastify/bearer-auth) contains an observable timing discrepancy (CWE-208) due to the insecure use of crypto.timingSafeEqual. The vulnerability arises because the comparison logic does not properly handle inputs of different lengths or fails to ensure constant-time execution during token validation. An unauthenticated remote attacker can use timing analysis to determine the length of a valid bearer token and subsequently perform a brute-force attack. Since bearer tokens typically use a limited Base64 character set, this timing leak significantly reduces the search space for token discovery. The issue is fixed in versions 7.0.2 and 8.0.1.
Affected products
- Fastify fastify-bearer-auth >= 5.0.1, < 7.0.2
- Fastify @fastify/bearer-auth < 7.0.2, 8.0.0
Timeline
- 2022-07-14: advisory: NVD and GitHub published the advisory
- 2022-07-15: disclosed: GHSA-376v-xgjx-7mfr published
- 2022-07-15: patched: Versions 7.0.2 and 8.0.1 released with fixes
References
- https://github.com/fastify/fastify-bearer-auth/security/advisories/GHSA-376v-xgjx-7mfr
- https://github.com/fastify/fastify-bearer-auth/commit/0c468a616d7e56126dc468150f6a5a92e530b8e4
- https://github.com/fastify/fastify-bearer-auth/commit/39353b15409ee99474545f615ffb16180cf3b716
- https://github.com/fastify/fastify-bearer-auth/commit/f921a0582dc83112039004a9b5041141b50c5b3f
- https://hackerone.com/reports/1633287
- https://github.com/fastify/fastify-bearer-auth