Summary

A timing attack vulnerability exists in Traefik's BasicAuth middleware that allows unauthenticated attackers to enumerate valid usernames. When a username exists, bcrypt password verification takes ~166ms; when it doesn't exist, the response returns immediately in ~0.6ms. This ~298x timing difference enables reliable username enumeration.

Details

The vulnerability exists in the BasicAuth middleware implementation. When validating credentials:

User exists: The system performs bcrypt password comparison, which intentionally takes ~100-200ms due to bcrypt's design

User doesn't exist: The system immediately returns authentication failure in ~0.6ms

This timing difference is observable over the network and allows attackers to distinguish between valid and invalid usernames.

Root Cause: The code returns early when the user is not found, without performing a dummy bcrypt comparison to maintain constant-time execution.

Expected behavior: The system should perform a bcrypt comparison regardless of whether the user exists, to maintain consistent response times.

PoC

Environment:

Traefik v3.6.9

k3s v1.34.5

Configuration:

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: basicauth
  namespace: traefik-poc
spec:
  basicAuth:
    secret: basic-auth-secret...
Show more

PoC Script:

#!/usr/bin/env python3
import requests
import time
import statistics
import sys
TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:30080/protected"
TEST_USERS = ["admin", "root", "test", "nonexistent12345"]
SAMPLES = 20...
Show more

Execution Results:

Target: http://10.10.10.7:30080/protected
Samples per user: 20

[+] EXISTS (slow - bcrypt verification): admin         | median=0.1665s
[-] NOT FOUND (fast - immediate return): root          | median=0.0006s
[-] NOT FOUND (fast - immediate return): test          | median=0.0006s
[-] NOT FOUND (fast - immediate return): nonexistent   | median=0.0006s
...
Show more

Impact

Vulnerability Type: Information Disclosure via Timing Attack (CWE-208)

Impact:

Attackers can enumerate valid usernames without authentication

Enables targeted password brute-force attacks against confirmed accounts

Exposes information about system user structure

Who is impacted: All users of Traefik's BasicAuth middleware are affected. The vulnerability requires:

BasicAuth middleware enabled

Attacker able to make requests to protected endpoints

Network access to measure response times

Attack Complexity: Low - only requires sending HTTP requests and measuring response times

Privileges Required: None

User Interaction: None