PT-2021-19825 · Auth0 · Auth0-Lock

Lzychowski · Published 2021-06-04 · Updated 2021-06-16 · CVE-2021-32641

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions auth0-lock versions 11.30.0 and earlier

Description The issue concerns a reflected XSS attack. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage, or the library's languageDictionary feature is utilized and user input or data from URL parameters is incorporated into the languageDictionary.

Recommendations For versions 11.30.0 and earlier, upgrade to version 11.30.1 to resolve the issue. As a temporary workaround, consider disabling the flashMessage and languageDictionary features until a patch is available. Restrict access to user input or data from URL parameters in these features to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-32641

GHSA-JR3J-WHM4-9WWM

Affected Products

Auth0-Lock

References · 8

• 🔥 https://github.com/auth0/lock/security/advisories/GHSA-jr3j-whm4-9wwm · Exploit
• https://github.com/auth0/lock/commit/d139cf01c8234b07caf265e051f39d3eab08f7ed · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32641 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32641 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jr3j-whm4-9wwm · Vendor Advisory
• https://github.com/auth0/lock/releases/tag/v11.30.1 · Note
• https://t.me/cvenotify/15617 · Telegram Post
• https://t.me/cvenotify/15611 · Telegram Post