VYPR
← All advisories
High severityNVD Advisory· Published Jul 29, 2022· Updated Sep 17, 2024

Timing Attack

CVE-2022-24912

Description

The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Atlantis webhook validator before 0.19.7 uses non-constant-time comparison for GitLab webhook secret, enabling timing attacks to recover secret and forge events.

The GitLab webhook event validator in Atlantis (before version 0.19.7) does not use a constant-time comparison function when validating the webhook secret. Instead, it performs a simple string comparison (headerSecret != secretStr), which is vulnerable to timing attacks [1][4]. This allows an attacker to recover the secret by measuring response times.

An attacker can send crafted webhook requests and observe the time difference in responses to deduce the secret character by character. The attack requires network access to the Atlantis server and the ability to send HTTP requests to the webhook endpoint. No authentication is needed beyond the secret itself. The GitHub and Bitbucket validators are not vulnerable because they use HMACs [4].

Successful recovery of the webhook secret allows the attacker to forge valid webhook events, potentially triggering unauthorized actions in Atlantis (e.g., running terraform plans/applies). The risk is considered low due to the difficulty of precise timing measurements over the network, but it is a real threat [4].

The fix was implemented in pull request #2392 [2] and released in version 0.19.7. Users should upgrade to at least 0.19.7. The Go vulnerability database also lists this as GO-2022-0534 [3].

References
  1. NVD - CVE-2022-24912
  2. fix: use constant time comparison of webhook secret in gitlab event validator by cedws · Pull Request #2392 · runatlantis/atlantis
  3. GO-2022-0534 - Go Packages
  4. GitLab webhook event validator vulnerable to timing attacks

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/runatlantis/atlantisGo
< 0.19.70.19.7

Affected products

5

Patches

1
48870911974a

fix: use constant time comparison of webhook secret in gitlab event validator (#2392)

https://github.com/runatlantis/atlantisConnor EdwardsJul 15, 2022via ghsa
commit
1 file changed · +2 −2
  • server/controllers/events/gitlab_request_parser_validator.go+2 −2 modified
    @@ -14,6 +14,7 @@
 package events
 
 import (
+	"crypto/subtle"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -61,8 +62,7 @@ func (d *DefaultGitlabRequestParserValidator) ParseAndValidate(r *http.Request,
 
 	// Validate secret if specified.
 	headerSecret := r.Header.Get(secretHeader)
-	secretStr := string(secret)
-	if len(secret) != 0 && headerSecret != secretStr {
+	if len(secret) != 0 && subtle.ConstantTimeCompare(secret, []byte(headerSecret)) != 1 {
 		return nil, fmt.Errorf("header %s=%s did not match expected secret", secretHeader, headerSecret)
 	}

Vulnerability mechanics

Synthesis attempt was rejected by the grounding validator. Re-run pending.

References

7

News mentions

0

No linked articles in our index yet.