CVE-2024-52307 in authentik
Summary
by MITRE • 11/21/2024
authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRET_KEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be accessed directly, as the Go proxy running in the authentik server container fetches data from this endpoint and serves it on a separate port (9300 by default), which can be scraped by Prometheus without being exposed publicly. authentik 2024.8.5 and 2024.10.3 fix this issue. Since the /-/metrics/ endpoint is not intended to be accessed publicly, requests to the endpoint can be blocked by the reverse proxy/load balancer used in conjunction with authentik.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2025
The vulnerability identified as CVE-2024-52307 affects authentik, an open-source identity provider implementation that serves as a comprehensive identity and access management solution. This security flaw resides in the authentication mechanism of the /-/metrics/ endpoint, which is designed to expose Prometheus metrics for monitoring purposes rather than direct user access. The endpoint operates through a Go-based proxy within the authentik server container, with metrics being served on a separate port 9300 for Prometheus scraping while maintaining the original endpoint's internal functionality. The vulnerability stems from the implementation of a non-constant time string comparison algorithm when processing authentication requests to this metrics endpoint, creating a timing side-channel attack vector that enables attackers to perform brute-force operations against the SECRET_KEY.
The technical flaw represents a classic implementation of CWE-208, which describes timing side-channel attacks that occur when cryptographic operations do not execute in constant time, thereby leaking information about the comparison process through timing variations. This vulnerability allows attackers to exploit the timing differences in string comparison operations to gradually deduce the SECRET_KEY value through repeated authentication attempts. The attack vector is particularly concerning because it targets an endpoint that, while not directly exposed to public internet traffic, remains accessible within the internal network infrastructure. The Go programming language's standard library implementation of string comparison functions typically does not provide constant-time comparisons, making this vulnerability exploitable through careful timing analysis of authentication responses.
The operational impact of this vulnerability extends beyond simple credential compromise, as the SECRET_KEY serves as the primary authentication mechanism for accessing the metrics endpoint. This creates a potential attack surface where unauthorized parties could gain access to sensitive monitoring data, potentially exposing system configurations, performance metrics, and operational details that could aid in subsequent attacks. The vulnerability's exploitation requires network access to the authentik server and the ability to make repeated requests to the metrics endpoint, but given the nature of timing attacks, even modest computational resources could eventually yield successful key recovery. The fact that this endpoint is typically accessed through internal proxies and load balancers means that the attack could originate from within the network perimeter, making detection more challenging.
Mitigation strategies for CVE-2024-52307 involve multiple layers of defense, beginning with immediate patching to authentik versions 2024.8.5 and 2024.10.3 which implement proper constant-time comparison algorithms. Network-level protections should include implementing access controls through reverse proxies and load balancers to block direct access to the /-/metrics/ endpoint, ensuring that only legitimate monitoring systems can reach the endpoint. Additional defensive measures encompass configuring authentication mechanisms at the network infrastructure level, implementing rate limiting to prevent brute-force attempts, and establishing monitoring for unusual access patterns to the metrics endpoint. Organizations should also consider implementing network segmentation to isolate the authentik service from unnecessary network access, thereby reducing the attack surface for potential exploitation. The vulnerability demonstrates the importance of applying security principles such as constant-time operations for cryptographic comparisons, which aligns with the broader ATT&CK framework's emphasis on credential access and defense evasion techniques that exploit implementation weaknesses in security controls.