id: GO-2020-0004
modules:
    - module: github.com/nanobox-io/golang-nanoauth
      versions:
        - introduced: 0.0.0-20160722212129-ac0cc4484ad4
        - fixed: 0.0.0-20200131131040-063a3fb69896
      vulnerable_at: 0.0.0-20190311151057-c2ebbac481bb
      packages:
        - package: github.com/nanobox-io/golang-nanoauth
          symbols:
            - Auth.ServeHTTP
            - Auth.ListenAndServeTLS
            - Auth.ListenAndServe
          derived_symbols:
            - ListenAndServe
            - ListenAndServeTLS
summary: Authentication bypass in github.com/nanobox-io/golang-nanoauth
description: |-
    If any of the ListenAndServe functions are called with an empty token, token
    authentication is disabled globally for all listeners.

    Also, a minor timing side channel was present allowing attackers with very low
    latency and able to make many requests to potentially recover the token.
published: 2021-04-14T20:04:52Z
ghsas:
    - GHSA-hrm3-3xm6-x33h
credits:
    - '@bouk'
references:
    - fix: https://github.com/nanobox-io/golang-nanoauth/pull/5
    - fix: https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3
cve_metadata:
    id: CVE-2020-36569
    cwe: 'CWE-305: Authentication Bypass by Primary Weakness'
    description: |-
        Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth
        between v0.0.0-20160722212129-ac0cc4484ad4 and
        v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty
        token.
review_status: REVIEWED