CVE-2016-10535 Timing Attack in csrf-lite
MediumCVSS 5.9
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses ===, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than (16*18)288 guesses, instead of the 16^18 guesses required were the timing attack not present.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm csrf-lite(npm) | < 0.1.2 | 0.1.2 |
| csrf-lite project csrf-lite | <= 0.1.1 | No fix listed |
| HackerOne csrf-lite node module | = <=0.1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com patch third-party-advisory
- github.com
- www.npmjs.com
- nodesecurity.io third-party-advisory