CWE-1254: Incorrect Comparison Logic Granularity

What is Incorrect Comparison Logic Granularity?

• Overview: Incorrect Comparison Logic Granularity is a vulnerability where the comparison logic processes data in smaller segments rather than in one complete operation, which can be exploited by attackers to gain sensitive information through timing attacks.

• Exploitation Methods:

• Attackers can exploit this vulnerability by timing how long it takes for comparisons to fail, allowing them to deduce the point of failure.
• Common attack patterns include observing the response times of failed authentication attempts to systematically guess correct values like passwords or cryptographic keys.

• Security Impact:

• Direct consequences include unauthorized access through successful guessing of passwords or cryptographic keys.
• Potential cascading effects could involve further privilege escalation, data breaches, or system control.
• Business impact includes loss of user trust, potential legal consequences, and financial losses from data breaches.

• Prevention Guidelines:

• Specific code-level fixes include using constant-time comparison functions that process the entire string or data structure in one operation.
• Security best practices involve ensuring that all sensitive comparisons are performed in a way that does not reveal timing information.
• Recommended tools and frameworks include libraries and functions specifically designed for cryptographically secure comparisons, often provided by modern cryptographic libraries.

Corgea can automatically detect and fix Incorrect Comparison Logic Granularity in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not Language-Specific

Affected Technologies: Not Technology-Specific

Vulnerable Code Example

function checkPassword(userInput, actualPassword) {
    // Vulnerable: The password comparison is done character by character
    for (let i = 0; i < Math.min(userInput.length, actualPassword.length); i++) {
        if (userInput[i] !== actualPassword[i]) {
            return false;
        }
    }
    // This logic checks if the lengths are the same, but it doesn't prevent timing attacks
    return userInput.length === actualPassword.length;
}

// Example usage
console.log(checkPassword("user_input_password", "actual_password"));

Explanation:

• The above code compares the password character by character. This method can be exploited through a timing attack, where an attacker measures the time taken to compare strings and infers the correct password character by character.
• The comparison logic reveals information based on the time it takes to return false, which can be used to guess the password.

How to fix Incorrect Comparison Logic Granularity?

To mitigate this issue in JavaScript, use a library function designed for constant-time string comparison. Libraries like crypto in Node.js provide such functionality.

Fixed Code Example

const crypto = require('crypto');

function checkPassword(userInput, actualPassword) {
    // Fixed: Use constant-time comparison to prevent timing attacks
    try {
        return crypto.timingSafeEqual(Buffer.from(userInput), Buffer.from(actualPassword));
    } catch (error) {
        // Handle error if input lengths are not the same
        return false;
    }
}

// Example usage
console.log(checkPassword("user_input_password", "actual_password"));

Explanation:

• The crypto.timingSafeEqual function is used to compare the strings in constant time, thus protecting against timing attacks.
• This function ensures that the comparison takes an equal amount of time, regardless of the number of matching characters, which prevents attackers from gaining information about the password through timing analysis.
• The try-catch block is used to handle potential errors when the lengths of the inputs are not equal, as crypto.timingSafeEqual requires buffers of the same length.