Executive brief
A security flaw was found in the Auth0 JavaScript library, which is used by websites to handle user logins. If a website uses the library's popup login feature, a malicious site could trick the browser into handing over the user's secret login tokens. This would allow an attacker to impersonate the user and access their account or perform actions on their behalf.
Technical details
A cross-origin vulnerability exists in auth0-js versions prior to 8.12.0 when using the auth0.popup.callback() method. The vulnerability stems from a failure to validate the origin and target of HTML5 postMessage events between the authentication popup window and the requesting page. An attacker can host a malicious webpage that opens the authentication popup and intercepts the sensitive access token sent via postMessage. This allows for unauthorized acquisition of authenticated user tokens and subsequent service invocation on the user's behalf. The issue is resolved in version 8.12.0.
Affected products
- Auth0 auth0-js < 8.12.0
Timeline
- 2017-12-06: advisory: NVD publication date
- 2017-12-13: disclosed: AppCheck public disclosure
- 2017-12-21: advisory: GitHub Advisory published