Possible Basic Auth Timing Attack in RPC server via nimiq_jsonrpc_server

[jsdanielh]

Link: https://hackerone.com/reports/2491447
Date: 2024-05-06 07:18:39 UTC
By: ryanrb
Weakness: Information Exposure Through Timing Discrepancy

Details:

Summary

Similar to #2447113, the basic auth implementation used in lib/src/extras/rpc_server.rs leverages nimiq_jsonrpc_server, which does a simplistic string comparison of passwords.

Project: core-rs-albatross
File reference: lib/src/extras/rpc_server.rs
Line: 67

use nimiq_jsonrpc_server::{AllowListDispatcher, Config, ModularDispatcher, Server as _Server};
// ...
pub type Server = _Server<AllowListDispatcher<ModularDispatcher>>;
//...

Ok(Server::new(
    Config {
        bind_to: (config.bind_to.unwrap_or_else(default_bind), config.port).into(),
        enable_websocket: false,
        ip_whitelist: None,
        basic_auth,
    },
    AllowListDispatcher::new(dispatcher, allowed_methods),
))

File reference: nimiq_jsonrpc_server:server/lib.rs (link)
Line: 180

if auth_header.0.username() == basic_auth.username
    && auth_header.0.password() == basic_auth.password

Recommendation

Use a time-safe comparison when it comes to the password check to avoid leaking information.

References:

• #2447113
• Github: Nimiq jsonrpc

Impact

The RPC server's basic auth password could potentially be compromised via timing analysis if the check in nimiq_jsonrpc_server is used as-is.