CVE-2020-15237 (published 2020-10-05T19:15Z)

In Shrine before version 3.3.0, when using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant time, using `Rack::Utils.secure_compare`. Users using the `derivation_endpoint` plugin are urged to upgrade to Shrine 3.3.0 or greater. A possible workaround is provided in the linked advisory.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.9, MEDIUM (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-203
cwe_name: Observable Discrepancy
description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: Discrepancies can take many forms, and variations may be detectable in timing, control flow, communications such as replies or requests, or general behavior. These discrepancies can reveal information about the product's operation or internal state to an unauthorized actor. In some cases, discrepancies can be used by attackers to form a side channel.
         
cwe_id: CWE-208
cwe_name: Observable Timing Discrepancy
description: Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
extended_description: 
	   In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations.  For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess.  Timing discrepancies effectively form a timing side channel.
	 
         

Fix information:
repo_url: https://github.com/shrinerb/shrine
commit_details: repo_url: https://github.com/shrinerb/shrine
author: Janko Marohnić
author_date: 2020-10-04 18:19:58+02:00
msg: Securely compare signature in derivation_endpoint

Using regular string comparison when comparing signature has different
performance depending on how much of the string matched, which can make
derivation_endpoint susceptible to timing attacks. We avoid that by
using `Rack::Utils.secure_compare` instead.

Big thanks to @esparta for reporting this.
repository: repo_url: https://github.com/shrinerb/shrine
repo_name: shrinerb/shrine
description: File Attachment toolkit for Ruby applications
repo_language: Ruby
owner: shrinerb
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,7 @@
 ## master
 
+* `derivation_endpoint` – Avoid possibility of timing attacks when comparing signatures (@esparta)
+
 * `derivatives` – Avoid downloading the attached file when calling default no-op processor (@janko)
 
 * `derivatives` – Add `:download` processor setting for skipping downloading source file (@jrochkind, @janko)

programming_language: Markdown
filename: derivation_endpoint.rb
change_type: ModificationType.MODIFY
diff: @@ -739,7 +739,7 @@ class Shrine
     def verify_signature(string, signature)
       if signature.nil?
         fail InvalidSignature, "missing \"signature\" param"
-      elsif signature != generate_signature(string)
+      elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
         fail InvalidSignature, "provided signature does not match the calculated signature"
       end
     end

programming_language: Ruby