CVE-2024-47178: Express Basic-auth-connect Timing Attack

CVE-2024-47178 Overview

CVE-2024-47178 affects basic-auth-connect, the standalone Basic Authentication middleware module for the Connect framework in Node.js. Versions prior to 1.1.0 perform credential validation using a timing-unsafe equality comparison. Attackers can measure the response time of authentication requests to infer valid credentials character by character. The maintainers fixed the issue in version 1.1.0 by adopting a constant-time comparison routine. The weakness is tracked under CWE-208: Observable Timing Discrepancy.

Critical Impact
A network-based attacker can recover valid Basic Auth credentials by exploiting timing side channels in the middleware's string comparison, leading to unauthorized access to protected routes.

Affected Products

expressjs/basic-auth-connect versions prior to 1.1.0
Node.js applications using Connect-based middleware stacks that mount basic-auth-connect
Downstream Express applications that depend on this module for HTTP Basic Authentication

Discovery Timeline

2024-09-30 - CVE-2024-47178 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-47178

Vulnerability Analysis

The basic-auth-connect middleware parses the Authorization header from incoming HTTP requests and compares the decoded username and password against configured values. Before version 1.1.0, this comparison relied on the JavaScript === operator, which returns as soon as it encounters differing characters. That early-exit behavior produces measurable timing differences correlated with how many leading characters of the supplied credential match the expected value.

An attacker with network access to an endpoint protected by the middleware can issue repeated authentication attempts and measure response latency. By iterating through candidate characters and retaining those that produce marginally longer processing times, the attacker can reconstruct the correct credentials without brute-forcing the full search space. The vulnerability requires no privileges or user interaction and is exploitable over the network.

Root Cause

The root cause is the use of a non-constant-time string comparison to validate a secret. Standard equality operators in JavaScript short-circuit on the first mismatched byte. When applied to authentication secrets, this leaks partial information about the correct value through processing time, which constitutes a classic side-channel weakness (CWE-208).

Attack Vector

Exploitation requires the ability to send HTTP requests to a service that uses basic-auth-connect and to measure response times with sufficient precision. Timing attacks over the public internet are difficult but feasible against low-jitter targets, and become significantly more reliable on local networks, shared hosting, or co-located cloud tenants. The attacker submits crafted Authorization: Basic headers, records timing samples, and applies statistical analysis to recover credentials one character at a time.

javascript

// Security patch in index.js — feat: add timing safe equal comparison
+var timingSafeCompare = require('tsscmp');
 var http = require('http');

 /*!

Source: expressjs/basic-auth-connect commit bac1e6a

The patch introduces the tsscmp (timing-safe string compare) module, which compares strings in time proportional to the input length rather than to the position of the first differing byte, eliminating the observable timing discrepancy.

Detection Methods for CVE-2024-47178

Indicators of Compromise

High volumes of HTTP 401 Unauthorized responses from endpoints protected by Basic Authentication, especially from a small set of source IP addresses.
Repeated Authorization: Basic headers containing systematically varying credential values consistent with byte-by-byte enumeration.
Unusual authentication request patterns with tight inter-request timing, suggesting automated latency measurement.

Detection Strategies

Perform a software composition analysis (SCA) scan of package.json and package-lock.json files across your repositories to enumerate services depending on basic-auth-connect at versions below 1.1.0.
Inspect running Node.js workloads and container images for the vulnerable module using tools such as npm ls basic-auth-connect in CI pipelines.
Correlate web server access logs with authentication failures to identify credential enumeration patterns targeting Basic Auth endpoints.

Monitoring Recommendations

Enable rate limiting and alerting on repeated authentication failures per source IP on endpoints served by Connect or Express applications.
Ingest application, reverse proxy, and WAF logs into a centralized analytics platform to baseline normal authentication patterns and alert on statistical outliers.
Track dependency inventory changes over time so downgrades to vulnerable versions of basic-auth-connect are detected during builds and deployments.

How to Mitigate CVE-2024-47178

Immediate Actions Required

Upgrade basic-auth-connect to version 1.1.0 or later in all affected applications and rebuild container images.
Audit production dependency trees for transitive references to vulnerable versions and force resolution to the patched release.
Rotate any Basic Auth credentials that were exposed via services running vulnerable versions, especially those reachable from untrusted networks.

Patch Information

The fix is available in basic-auth-connect version 1.1.0, which replaces the unsafe === comparison with the tsscmp constant-time compare function. Details are documented in GitHub Security Advisory GHSA-7p89-p6hx-q4fw and the upstream patch commit.

Workarounds

Migrate protected endpoints to a stronger authentication mechanism such as OAuth 2.0, session tokens, or mutual TLS where feasible.
Place affected services behind a reverse proxy or WAF that enforces rate limiting and blocks rapid credential enumeration attempts.
If patching is delayed, replace the middleware locally with a wrapper that performs credential comparison using Node.js's built-in crypto.timingSafeEqual.

bash

# Upgrade the vulnerable package to the patched release
npm install basic-auth-connect@^1.1.0

# Verify the resolved version in your dependency tree
npm ls basic-auth-connect

# Audit the project for known advisories
npm audit --production