Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-3642

CVE-2021-3642: Observable Discrepancy in Wildfly Elytron

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-3642
GHSA ID
GHSA-5499-qjvh-6j7w
EPSS Score
0.44937%
CWE
CWE-203
Published
5/24/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.wildfly.security:wildfly-elytronmaven<= 1.10.131.10.14
org.wildfly.security:wildfly-elytronmaven>= 1.11.0, <= 1.15.41.15.5
org.wildfly.security:wildfly-elytronmaven= 1.16.01.16.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability specifically affects ScramServer's proof verification mechanism. Timing attacks require observable differences in processing time between valid and invalid inputs. The critical point would be in client proof validation where a standard string comparison (non-constant-time) was likely used. While no direct patch is shown, the CWE-203 classification and SCRAM protocol context indicate proof comparison functions as the vulnerable area. The main vulnerable function would be the direct proof validator(), with the authentication handler being a secondary indicator.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *l*w w*s *oun* in Wil**ly *lytron w**r* S*r*mS*rv*r m*y ** sus**pti*l* to Timin* *tt**k i* *n**l**. T** *i***st t*r**t o* t*is vuln*r**ility is *on*i**nti*lity. T*is *l*w *****t*s Wil**ly *lytron v*rsions prior to *.**.**.*in*l, prior to *.**.*.*in

Reasoning

T** vuln*r**ility sp**i*i**lly *****ts S*r*mS*rv*r's proo* v*ri*i**tion m****nism. Timin* *tt**ks r*quir* o*s*rv**l* *i***r*n**s in pro**ssin* tim* **tw**n v*li* *n* inv*li* inputs. T** *riti**l point woul* ** in *li*nt proo* v*li**tion w**r* * st*n*