Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-46739

CVE-2023-46739: CubeFS timing attack can leak user passwords

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-46739
GHSA ID
GHSA-8579-7p32-f398
EPSS Score
0.19724%
CWE
CWE-203
Published
1/3/2024
Updated
11/18/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/cubefs/cubefsgo< 3.3.13.3.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure password comparison in UserService. The commit diff shows the vulnerable code was directly comparing plaintext passwords with 'ak.Password != args.Password'. String comparisons in Go are not constant-time - they exit early on first mismatch, creating observable timing differences. This allows attackers to perform statistical analysis to guess password characters. The patched version replaced this with hashed comparisons, confirming the original function's vulnerability. The file path and function name are explicitly shown in the diff and vulnerability description.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* *urin* in t** *u***S m*st*r *ompon*nt t**t *oul* *llow *n untrust** *tt**k*r to st**l us*r p*sswor*s *y **rryin* out * timin* *tt**k. T** root **s* o* t** vuln*r**ility w*s t**t *u***S us** r*w strin* *omp*rison o* p*sswor*s

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* p*sswor* *omp*rison in `Us*rS*rvi**`. T** *ommit *i** s*ows t** vuln*r**l* *o** w*s *ir**tly *omp*rin* pl*int*xt p*sswor*s wit* '*k.P*sswor* != *r*s.P*sswor*'. Strin* *omp*risons in *o *r* not *onst*nt-tim* - t**