CVE-2024-47178 basic-auth-connect's callback uses time unsafe string comparison
An attacker can exploit timing differences in string comparison to potentially recover authentication credentials from the basic-auth-connect middleware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47178?
CVE-2024-47178 is a high-severity vulnerability in expressjs basic-auth-connect, published on 30 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.
Weakness: CWE-208
Which versions are affected by CVE-2024-47178?
2 open source packages ship an affected version, including basic-auth-connect. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
basic-auth-connect npm | All versions | 1.1.0 |
basic-auth-connect npm | All versions | 1.1.0 |
Products include Expressjs Basic-Auth-Connect.
How do I fix CVE-2024-47178?
Upgrade basic-auth-connect to 1.1.0 or later.
Is CVE-2024-47178 being exploited?
There is no known exploitation of CVE-2024-47178 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1773533800, GHSA-7p89-p6hx-q4fw, MINI-823v-hm46-mpxf, ROOT-APP-NPM-CVE-2024-47178.