PT-2022-20596 · Next-Auth · Next-Auth
Balazsorban44
+1
·
Published
2022-08-01
·
Updated
2022-08-09
·
CVE-2022-31186
CVSS v3.1
3.3
Low
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
next-auth versions prior to v4.10.2
next-auth versions prior to v3.29.9
Description
An information disclosure issue allows an attacker with log access privilege to obtain excessive information, such as an identity provider's secret in the log, which is thrown during OAuth error handling. This can be used to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. The issue has been patched by moving the log for provider information to the debug level, and a warning has been added for having the debug option turned on in production.
Recommendations
For versions prior to v4.10.2 and v3.29.9, upgrade to v4.10.2 or v3.29.9 to patch the vulnerability.
If upgrading is not possible, use the logger configuration option by sanitizing the logs to prevent information disclosure.
Consider setting debug: process.env.NODE ENV !== "production" to only allow debugging while not in production.
Set the logger option with proper sanitization of potentially sensitive user information if logging debug messages during production is necessary.
Exploit
Fix
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Next-Auth