CVE-2024-23771
📋 TL;DR
This vulnerability in darkhttpd allows remote attackers to bypass authentication via timing side-channel attacks. The web server uses non-constant-time string comparison (strcmp) for password verification, enabling attackers to guess credentials by measuring response times. Anyone running darkhttpd versions before 1.15 with authentication enabled is affected.
💻 Affected Systems
- darkhttpd
📦 What is this software?
Darkhttpd by Unix4lyfe
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to protected resources, potentially leading to data theft, privilege escalation, or further system compromise.
Likely Case
Authentication bypass enabling unauthorized access to protected web content and resources served by darkhttpd.
If Mitigated
Limited impact with proper network segmentation and additional authentication layers, though the vulnerability still exists.
🎯 Exploit Status
Exploitation requires timing measurements and multiple requests, but tools exist for timing attacks. The vulnerability is well-documented with proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.15
Vendor Advisory: https://github.com/emikulic/darkhttpd/commit/f477619d49f3c4de9ad59bd194265a48ddc03f04
Restart Required: Yes
Instructions:
1. Download darkhttpd 1.15 or later from GitHub. 2. Compile the new version. 3. Replace the existing darkhttpd binary. 4. Restart the darkhttpd service.
🔧 Temporary Workarounds
Disable Authentication
allRemove authentication requirements if not strictly necessary
Remove or rename .htpasswd files
Remove Auth directives from configuration
Use Reverse Proxy with Secure Auth
linuxPlace darkhttpd behind a reverse proxy (nginx, Apache) that handles authentication securely
Configure nginx/apache as reverse proxy with auth
Disable darkhttpd authentication
🧯 If You Can't Patch
- Implement network-level controls to restrict access to darkhttpd instances
- Add additional authentication layer (VPN, IP whitelisting, application firewall)
🔍 How to Verify
Check if Vulnerable:
Check darkhttpd version with 'darkhttpd --version' or examine binary timestamp against release dates. Check if authentication is configured by looking for .htpasswd files or Auth directives.Check Version:
darkhttpd --versionVerify Fix Applied:
Verify version is 1.15 or later. Check that the binary includes the constant-time comparison fix by examining the commit or build.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts with varying response times
- Successful authentication after many attempts
- Unusual timing patterns in access logs
Network Indicators:
- Repeated authentication requests to protected endpoints
- Traffic patterns suggesting timing measurements
SIEM Query:
source="darkhttpd" AND (event="AUTH_FAILED" OR status=401) | stats count by src_ip, uri | where count > 100🔗 References
- http://www.openwall.com/lists/oss-security/2024/01/25/1
- https://github.com/emikulic/darkhttpd/commit/f477619d49f3c4de9ad59bd194265a48ddc03f04
- https://github.com/emikulic/darkhttpd/compare/v1.14...v1.15
- http://www.openwall.com/lists/oss-security/2024/01/25/1
- https://github.com/emikulic/darkhttpd/commit/f477619d49f3c4de9ad59bd194265a48ddc03f04
- https://github.com/emikulic/darkhttpd/compare/v1.14...v1.15
