CVE-2023-32691
published 2023-05-30CVE-2023-32691: gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a…
PriorityP431medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
0.57%
43.5th percentile
gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparison function. Untrusted input, sourced from a HTTP header, is compared directly with a secret. Since this comparison is not secure, an attacker can mount a side-channel timing attack to guess the password. As a workaround, this can be easily fixed using a constant time comparing function such as `crypto/subtle`'s `ConstantTimeCompare`.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ginuerzh | gost | <= 2.11.5 | — |
| github.com | ginuerzh_gost | 0 – 2.11.5 | — |
| go_simple_tunnel_project | go_simple_tunnel | <= 2.11.5 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
ginuerzh/gost vulnerable to Timing Attack
ghsa·2023-05-22
CVE-2023-32691 [MEDIUM] CWE-203 ginuerzh/gost vulnerable to Timing Attack
ginuerzh/gost vulnerable to Timing Attack
[Timing attacks](https://en.wikipedia.org/wiki/Timing_attack) occur when an attacker can guess a secret by observing a difference in processing time for valid and invalid inputs. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparision function.
More information on this attack type can be found in [this blog post](https://verboselogging.com/2012/08/20/a-timing-attack-in-action).
# Root Cause Analysis
In this case, the vulnerability occurs due to the following code.
https://github.com/ginuerzh/gost/blob/1c62376e0880e4094bd3731e06bd4f7842638f6a/auth.go#L46-L46
Here, a untrusted input, sourced from a HTTP header, is compared directly with a secret.
Since, this comparision is not secure, an
OSV
ginuerzh/gost vulnerable to Timing Attack
osv·2023-05-22
CVE-2023-32691 [MEDIUM] ginuerzh/gost vulnerable to Timing Attack
ginuerzh/gost vulnerable to Timing Attack
[Timing attacks](https://en.wikipedia.org/wiki/Timing_attack) occur when an attacker can guess a secret by observing a difference in processing time for valid and invalid inputs. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparision function.
More information on this attack type can be found in [this blog post](https://verboselogging.com/2012/08/20/a-timing-attack-in-action).
# Root Cause Analysis
In this case, the vulnerability occurs due to the following code.
https://github.com/ginuerzh/gost/blob/1c62376e0880e4094bd3731e06bd4f7842638f6a/auth.go#L46-L46
Here, a untrusted input, sourced from a HTTP header, is compared directly with a secret.
Since, this comparision is not secure, an
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/ginuerzh/gost/blob/1c62376e0880e4094bd3731e06bd4f7842638f6a/auth.go#L46https://github.com/ginuerzh/gost/security/advisories/GHSA-qjrq-hm79-49wwhttps://github.com/ginuerzh/gost/blob/1c62376e0880e4094bd3731e06bd4f7842638f6a/auth.go#L46https://github.com/ginuerzh/gost/security/advisories/GHSA-qjrq-hm79-49ww
2023-05-30
Published