GHSA-g3hg-j4jv-cwfr

Summary

A timing attack vulnerability exists in Traefik's BasicAuth middleware that allows unauthenticated attackers to enumerate valid usernames. When a username exists, bcrypt password verification takes ~166ms; when it doesn't exist, the response returns immediately in ~0.6ms. This ~298x timing difference enables reliable username enumeration.

Details

The vulnerability exists in the BasicAuth middleware implementation. When validating credentials:

• User exists: The system performs bcrypt password comparison, which intentionally takes ~100-200ms due to bcrypt's design
• User doesn't exist: The system immediately returns authentication failure in ~0.6ms

This timing difference is observable over the network and allows attackers to distinguish between valid and invalid usernames.

Root Cause: The code returns early when the user is not found, without performing a dummy bcrypt comparison to maintain constant-time execution.

Expected behavior: The system should perform a bcrypt comparison regardless of whether the user exists, to maintain consistent response times.

PoC

Environment:

• Traefik v3.6.9
• k3s v1.34.5

Configuration:

PoC Script:

Execution Results:

Impact

• Vulnerability Type: Information Disclosure via Timing Attack (CWE-208)
• Impact:
  • Attackers can enumerate valid usernames without authentication
  • Enables targeted password brute-force attacks against confirmed accounts
  • Exposes information about system user structure
• Who is impacted: All users of Traefik's BasicAuth middleware are affected. The vulnerability requires:
  • BasicAuth middleware enabled
  • Attacker able to make requests to protected endpoints
  • Network access to measure response times
• Attack Complexity: Low - only requires sending HTTP requests and measuring response times
• Privileges Required: None
• User Interaction: None