PT-2021-19868 · Auth0 · @Auth0/Nextjs-Auth0

Git-Ishanpatel + 1 · Published 2021-06-25 · Updated 2021-07-01 · CVE-2021-32702

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions @auth0/nextjs-auth0 versions prior to 1.4.2

Description The issue concerns a reflected XSS vulnerability. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter, which is then processed by the callback handler as an error message. Users are affected if they are using @auth0/nextjs-auth0 version 1.4.1 or lower, unless they are using custom error handling that does not return the error message in an HTML response.

Recommendations Upgrade to version 1.4.2 to resolve the issue. The fix adds basic HTML escaping to the error message. As a temporary workaround, consider using custom error handling that does not return the error message in an HTML response to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-32702

GHSA-954C-JJX6-CXV7

Affected Products

@Auth0/Nextjs-Auth0

References · 7

• https://github.com/auth0/nextjs-auth0/commit/6996e2528ceed98627caa28abafbc09e90163ccf · Patch
• https://osv.dev/vulnerability/GHSA-954c-jjx6-cxv7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32702 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32702 · Security Note
• https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-954c-jjx6-cxv7 · Note
• https://npmjs.com/package/%40auth0/nextjs-auth0 · Note
• https://npmjs.com/package/@auth0/nextjs-auth0 · Note