Timing Attack in FileBrowser Quantum

Executive Summary

This vulnerability is a timing side-channel issue in FileBrowser Quantum's authentication system. The /api/auth/login endpoint does not execute in constant time, allowing attackers to determine valid usernames by measuring response delays. Valid usernames trigger a bcrypt password comparison, causing a measurable delay (~40-50ms), while invalid usernames return a quick response (1-4ms).

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor response times during authentication attempts. Send login requests with valid and invalid usernames and measure the time difference. A significant delay (~40-50ms) for valid usernames indicates the vulnerability exists. Use tools like curl or Python scripts to automate this test.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to identify valid user accounts, enabling targeted password-guessing, credential-stuffing, or social engineering attacks. This compromises account security and may lead to unauthorized access if weak passwords are used.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling unauthorized username enumeration. Attackers could identify valid accounts, increasing risks of credential stuffing or brute-force attacks. GDPR requires protecting personal data, and HIPAA mandates safeguarding user credentials. A breach of this nature may violate principles of data protection and access control.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to FileBrowser version 1.3.2-beta or later to patch the timing side-channel issue. If upgrading is not immediately possible, implement constant-time authentication checks manually or restrict access to the /api/auth/login endpoint temporarily.

Useful 0 Not Useful 0