PT-2020-14205 · Auth0 · Auth0

Osdiab · Published 2020-07-29 · Updated 2021-04-28 · CVE-2020-15125

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions auth0 versions prior to 2.27.1

Description The issue arises from the lack of sanitization of the Authorization header key in the error object, potentially exposing a bearer token when a request to the Auth0 management API fails. This affects users of the auth0 npm package who are using a Machine to Machine application authorized to use Auth0's management API.

Recommendations For versions prior to 2.27.1, upgrade to version 2.27.1 to resolve the issue. As a temporary workaround, consider restricting access to the Authorization header to minimize the risk of exploitation.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2020-15125

GHSA-5JPF-PJ32-XX53

Affected Products

Auth0

References · 7

• https://github.com/auth0/node-auth0/pull/507/commits/62ca61b3348ec8e74d7d00358661af1a8bc98a3c · Patch
• https://github.com/auth0/node-auth0/pull/507 · Patch
• https://osv.dev/vulnerability/CVE-2020-15125 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15125 · Security Note
• https://osv.dev/vulnerability/GHSA-5jpf-pj32-xx53 · Vendor Advisory
• https://github.com/auth0/node-auth0/tree/v2.27.1 · Note
• https://github.com/auth0/node-auth0/security/advisories/GHSA-5jpf-pj32-xx53 · Note