Listen to this Post
The vulnerability exists within the SCRAM authentication mechanism’s Java implementation. During the authentication handshake, the client computes a ‘ClientProof’ and the server computes a ‘ServerSignature’; both are derived from shared secrets. The critical flaw was the use of `Arrays.equals()` to validate if the client’s proof matched the server’s computed value and to verify the server’s signature. The `Arrays.equals()` method employs a short-circuiting comparison: it returns false immediately upon finding the first non-matching byte. This creates a timing discrepancy where responses for incorrect proofs are returned slightly faster when the initial bytes are wrong compared to when the first few bytes are correct. A remote attacker can exploit this by sending numerous authentication attempts with meticulously crafted passwords and measuring the server’s response times. By statistically analyzing these minute timing differences across many requests, the attacker can gradually deduce the correct secret byte-by-byte, ultimately compromising the user’s credentials.
Platform: SCRAM Java Implementation
Version: < 3.2
Vulnerability: Timing Side-Channel
Severity: Critical
date: 2021-03-30
Prediction: Patched in v3.2
What Undercode Say:
Simulating timing difference (Conceptual)
for i in {0..255}; do
crafted_proof=$(printf "\x$(printf %02x $i).....")
time curl -d "proof=$crafted_proof" http://target/login
done
// Vulnerable Code
if (Arrays.equals(clientProof, serverProof)) {
// grant access
}
// Patched Code
if (MessageDigest.isEqual(clientProof, serverProof)) {
// grant access
}
How Exploit:
Measure response timings.
Brute-force byte-by-byte.
Statistically analyze results.
Reconstruct authentication secret.
Protection from this CVE
Upgrade to v3.2.
Use constant-time comparisons.
Replace Arrays.equals everywhere.
Impact:
Credential compromise.
Authentication bypass.
Side-channel information leakage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
