Miggo Logo

CVE-2022-29185: Observable Timing Discrepancy in totp-rs

4.2

CVSS Score
3.1

Basic Information

EPSS Score
0.56245%
Published
5/24/2022
Updated
6/13/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
totp-rsrust< 1.1.01.1.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from using regular string comparison (==) in the token validation logic. The commit diff shows the critical fix replaced this with constant_time_eq() in TOTP<T>::check. This function's comparison of generated tokens with user input was vulnerable to timing analysis, as string equality checks in most languages (including Rust) short-circuit on first mismatch. The direct replacement with a constant-time comparison function in the patched version confirms this was the vulnerable point.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Tok*n *omp*rison w*s not *onst*nt tim*, *n* *oul* t**ori**lly ** us** to *u*ss v*lu* o* *n TOTP tok*n, *n* t*us r*us* it in t** s*m* tim* win*ow. T** *tt**k*r woul* **v* to know t** p*sswor* ***or***n* non*t**l*ss. ### P*t***s Li*r*ry now

Reasoning

T** vuln*r**ility st*mm** *rom usin* r**ul*r strin* *omp*rison (==) in t** tok*n v*li**tion lo*i*. T** *ommit *i** s*ows t** *riti**l *ix r*pl**** t*is wit* *onst*nt_tim*_*q() in TOTP<T>::****k. T*is *un*tion's *omp*rison o* **n*r*t** tok*ns wit* us*