basic-auth-connect's callback uses time unsafe string comparison

Vulnerability

Overview

basic-auth-connect, a Node.js middleware for HTTP Basic Authentication, prior to version 1.1.0, performs user credential verification using a non-constant-time string comparison (==). This timing-unsafe equality check allows an attacker to deduce valid username/password pairs by measuring the time taken for the comparison to fail, thus leaking authentication information through a timing side channel.

Attack

Vector and Exploitation

The vulnerability is exploitable remotely with low complexity and no required privileges or user interaction [1][2]. An attacker in a position to make repeated HTTP requests to the target service can measure response variations to infer correct characters of the credentials without needing prior authentication. Timing differences exist because the == operator in JavaScript returns early upon mismatched characters, making the comparison duration proportional to the number of matching prefix characters.

Impact and

Mitigation

A successful timing attack can lead to full authentication bypass, granting the attacker access to protected resources with the privileges of the compromised user. This directly impacts confidentiality and integrity of the application [2]. The issue has been fixed in version 1.1.0 by adopting a timing-safe comparison function (tsscmp) for all credential checks [4]. Users are strongly advised to update to the latest version to mitigate the risk.