PT-2022-2605 · Auth0 · Auth0

Evansimspublished · Published 2022-05-05 · Updated 2023-03-01 · CVE-2022-29172

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Auth0 versions prior to 11.33.0

Description The issue is related to the "additional signup fields" feature in Auth0, where a malicious actor can inject invalidated HTML code into these fields, which is then stored in the service user metdata payload using the name property. This can allow an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient's name within the delivered email template.

Recommendations For versions prior to 11.33.0, upgrade to version 11.33.0 to fix the issue. As a temporary workaround, consider restricting the use of the "additional signup fields" feature until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-03063

CVE-2022-29172

GHSA-7WW6-75FJ-JCJ7

Affected Products

Auth0

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29172.json · Exploit
• https://github.com/auth0/lock/commit/79ae557d331274b114848150f19832ae341771b1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29172 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29172 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7ww6-75fj-jcj7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03063 · Security Note
• https://github.com/auth0/lock · Note
• https://github.com/auth0/lock/security/advisories/GHSA-7ww6-75fj-jcj7 · Note
• https://t.me/cibsecurity/42068 · Telegram Post
• https://t.me/cvenotify/29774 · Telegram Post