Lucene search

Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-FA5AA13A3F1B2ADB2197ECD654A17AA7

HistoryApr 18, 2024 - 12:00 a.m.

1Panel's password verification is suspected to have a timing attack vulnerability

2024-04-1800:00:00

https://gitlab.com/gitlab-org/security-products/gemnasium-db

gitlab.com

panel

password verification

timing attack

vulnerability

hmac.equal

software

CVSS3

3.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

AI Score

7.2

Confidence

Low

EPSS

Percentile

9.0%

JSON

源码中密码校验处使用 != 符号，而不是hmac.Equal，这可能导致产生计时攻击漏洞，从而爆破密码。
建议使用 hmac.Equal 比对密码。

Affected configurations

Vulners

Node

go1panelRange<1.10.3

VendorProductVersionCPE
go1panel*cpe:2.3:a:go:1panel:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
go	1panel	*	cpe:2.3:a:go:1panel::::::::

References

github.com/1Panel-dev/1Panel

github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26

github.com/1Panel-dev/1Panel/security/advisories/GHSA-6m9h-2pr2-9j8f

github.com/advisories/GHSA-6m9h-2pr2-9j8f

nvd.nist.gov/vuln/detail/CVE-2024-30257

CVSS3

3.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

AI Score

7.2

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for GITLAB-FA5AA13A3F1B2ADB2197ECD654A17AA7