PT-2023-21166 · Npm · Nextauth.Js

Findarkside · Published 2023-03-09 · Updated 2023-04-20 · CVE-2023-27490

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions NextAuth.js versions prior to v4.20.1

Description The issue allows a bad actor to intercept and tamper with the authorization URL, enabling them to log in as the victim and bypass CSRF protection. This occurs due to a partial failure during a compromised OAuth session where a session code is erroneously generated. The estimated number of potentially affected devices is not specified.

Technical details about exploitation include:

• API Endpoints: /api/auth/callback/:providerId
• Vulnerable Parameters or Variables: state, pkce, and nonce
• Function Names: Not explicitly mentioned

Recommendations For versions prior to v4.20.1, upgrade to version v4.20.1 or later by running npm i next-auth@latest, yarn add next-auth@latest, or pnpm add next-auth@latest. As a temporary workaround for users unable to upgrade, consider using Advanced Initialization to manually check the callback request for state, pkce, and nonce against the provider configuration, and abort the sign-in process if there is a mismatch.

Exploit

Fix

CSRF

Session Fixation

Weakness Enumeration

CWE-352

CWE-384

Related Identifiers

CVE-2023-27490

GHSA-7R7X-4C4Q-C4QF

Affected Products

Nextauth.Js

References · 14

• 🔥 https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27490.json · Exploit
• https://osv.dev/vulnerability/GHSA-7r7x-4c4q-c4qf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27490 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27490 · Vendor Advisory
• https://github.com/nextauthjs/next-auth · Note
• https://github.com/nextauthjs/next-auth/compare/next-auth@4.20.0...next-auth@4.20.1#diff-cf9257195d0cb6a835ae4ff1fc73fe2cac0bab847efb0832c1f551209a972b47R55 · Note
• https://t.me/cibsecurity/59765 · Telegram Post
• https://next-auth.js.org/configuration/initialization#advanced-initialization · Note
• https://security.netapp.com/advisory/ntap-20230420-0006 · Note
• https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not · Note
• https://rfc-editor.org/rfc/rfc6749#section-10.12 · Note
• https://authjs.dev/reference/core/providers#checks · Note
• https://next-auth.js.org/configuration/providers/oauth · Note