Traefik BasicAuth Middleware Timing Attack Vulnerability Allowing Username Enumeration

A vulnerability exists in Traefik's BasicAuth middleware, allowing for username enumeration through a timing attack. This issue is present in Traefik versions 2.11.40 and earlier, 3.0.0-beta1 to 3.6.10, and 3.7.0-ea.1. The vulnerability arises because when a valid username is submitted, the middleware takes approximately 166 milliseconds to respond due to a bcrypt password comparison. In contrast, responses for non-existent usernames are nearly instantaneous, around 0.6 milliseconds. This significant timing difference, which is observable over the network, enables an unauthenticated attacker to reliably identify valid usernames.

Impact

Exploitation of this vulnerability allows for reliable username enumeration, as an attacker can distinguish between valid and invalid usernames based on the response time.

Remediation

Users can upgrade to Traefik versions 2.11.41, 3.6.11, or 3.7.0-ea.2 to address this vulnerability.