CVE-2024-52307: authentik allows a timing attack due to missing constant time comparison for metrics view
authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be accessed directly, as the Go proxy running in the authentik server container fetches data from this endpoint and serves it on a separate port (9300 by default), which can be scraped by Prometheus without being exposed publicly. authentik 2024.8.5 and 2024.10.3 fix this issue. Since the /-/metrics/ endpoint is not intended to be accessed publicly, requests to the endpoint can be blocked by the reverse proxy/load balancer used in conjunction with authentik.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52307?
CVE-2024-52307 has a high severity due to the potential for brute-forcing the SECRET_KEY used for authentication.
How do I fix CVE-2024-52307?
To mitigate CVE-2024-52307, upgrade Authentik to a version later than 2024.10.3.
Which versions of Authentik are affected by CVE-2024-52307?
Versions of Authentik from 2024.8.5 to 2024.10.3 are affected by CVE-2024-52307.
What functionality is compromised by CVE-2024-52307?
CVE-2024-52307 compromises the security of the /-/metrics/ endpoint, allowing for potential unauthorized access to Prometheus metrics.
Does CVE-2024-52307 affect the overall security of Authentik?
Yes, CVE-2024-52307 impacts the overall security of Authentik by exposing the SECRET_KEY to potential brute-force attacks.