PT-2022-20548 · Unknown · Nextauth.Js
Sandiipmaity
·
Published
2022-07-06
·
Updated
2022-07-14
·
CVE-2022-31127
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
NextAuth.js versions prior to 3.29.8
NextAuth.js versions prior to 4.9.0
Description
An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. For example, an attacker can send an email with a link to their site, which will be rendered in the HTML. This issue has been remedied in the following releases by not rendering the email in the HTML.
The vulnerable
email parameter is passed to sendVerificationRequest and rendered in the HTML. If a custom sendVerificationRequest is created, it is necessary to either exclude email from the HTML body or efficiently sanitize it.Recommendations
For NextAuth.js versions prior to 3.29.8, upgrade to version 3.29.8 or later.
For NextAuth.js versions prior to 4.9.0, upgrade to version 4.9.0 or later.
As a temporary workaround, consider sanitizing the
email parameter that is passed to sendVerificationRequest and rendered in the HTML. If a custom sendVerificationRequest is created, make sure to either exclude email from the HTML body or efficiently sanitize it.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nextauth.Js