Executive brief
express-basic-auth is a Node.js library that provides HTTP Basic Authentication for Express applications. Versions prior to 1.1.7 use ordinary string comparison for credential validation, which is vulnerable to timing attacks. An attacker can measure response times to infer the correct password character-by-character, making brute-force attacks more efficient and reducing the effectiveness of longer, more complex passwords.
Technical details
This vulnerability (CWE-208) stems from the use of native string comparison instead of constant-time string comparison in the credential validation logic. The attack vector is network-based, requiring no authentication or special privileges, though practical exploitation requires precise timing measurements. An attacker can observe minute differences in response times to determine which characters are correct in the credentials, significantly reducing the computational effort required for brute-force attacks. The vulnerability is fixed in version 1.1.7 and later by implementing constant-time string comparison.
Affected products
- npm express-basic-auth <1.1.7
Timeline
- 2019-06-06: disclosed