PT-2020-10358 · Auth0 · Auth0-Lock

Muhamad Visat · Published 2020-01-31 · Updated 2020-02-05 · CVE-2019-20174

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Auth0 Lock versions prior to 11.21.0

Description The issue arises when additionalSignUpFields is used with an untrusted placeholder in Auth0 Lock, allowing cross-site scripting (XSS) on signup pages. This occurs when the placeholder property is obtained from an untrusted source, such as a query parameter, and is used to add a checkbox to the sign-up dialog. The vulnerability is present in versions of Auth0 Lock where the generated HTML code is not properly sanitized.

Recommendations For Auth0 Lock versions prior to 11.21.0, upgrade to version 11.21.0 or later to fix the issue. In version 11.21.0, the placeholder property is treated as plain text, and a new placeholderHTML property is introduced for use with trusted sources. Developers using the placeholder property with HTML content from a trusted source should start using the placeholderHTML property to maintain the user experience.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20174

GHSA-W2PF-G6R8-PG22

Affected Products

Auth0-Lock

References · 8

• 🔥 https://auth0.com/docs/security/bulletins/cve-2019-20174 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-20174 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20174 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w2pf-g6r8-pg22 · Vendor Advisory
• https://github.com/auth0/lock/releases/tag/v11.21.0 · Note
• https://github.com/auth0/lock/security/advisories/GHSA-w2pf-g6r8-pg22 · Note
• https://github.com/auth0/lock/commit/6c15e5659c21cd814ea119af5c51b61399598dd5 · Note
• https://t.me/cvenotify/735 · Telegram Post