From 1ca2a0025513812885146f5e5d7fe06978167516 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Helleu?= Date: Sat, 30 May 2026 20:49:55 +0200 Subject: [PATCH] core: fix timing attack on TOTP validation (GHSA-vhv8-g2r9-cwcc) weecrypto_totp_validate compared the generated and client-supplied OTPs with strcmp and broke out of the time-window loop on the first match. Both choices leaked information via response timing: strcmp leaked the expected OTP digit-by-digit (shrinking the brute-force search from ~10^digits to a handful of guesses within the 30-second window), and the early break leaked which window offset matched. Compare in constant time with string_memcmp_constant_time and always iterate the full window, OR-ing the result into otp_ok without an early exit. This affects both relay protocols (which call totp_validate via the public info hook) and any other caller of the info hook. --- CHANGELOG.md | 1 + src/core/core-crypto.c | 11 +++++++---- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0c43cf685..b9f1817ea 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,7 @@ SPDX-License-Identifier: GPL-3.0-or-later - irc: fix tag in message with list of names when joining a channel - relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3)) - relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc)) +- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc)) ## Version 4.9.0 (2026-03-29) diff --git a/src/core/core-crypto.c b/src/core/core-crypto.c index fbda128e6..a4f3fd26b 100644 --- a/src/core/core-crypto.c +++ b/src/core/core-crypto.c @@ -660,15 +660,18 @@ weecrypto_totp_validate (const char *secret_base32, time_t totp_time, otp_ok = 0; + /* + * Compare in constant time and never break early: a non-constant + * compare and an early exit on match would let an observer measure + * how many digits of the expected OTP they got right and which + * time-window offset matched. + */ for (i = moving_factor - window; i <= moving_factor + window; i++) { rc = weecrypto_totp_generate_internal (secret, length_secret, i, digits, str_otp); - if (rc && (strcmp (str_otp, otp) == 0)) - { + if (rc && (string_memcmp_constant_time (str_otp, otp, digits) == 0)) otp_ok = 1; - break; - } } free (secret);