Is CVE-2018-6874 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-6874 being exploited in the wild.

How severe is CVE-2018-6874?

Low severity, with a CVSS score of 3, published 6 November 2018.

Which products and versions are affected?

auth0-js (npm) SEMVER:introduced=0,fixed=9.0.0.

Is there a fix for CVE-2018-6874?

Yes. auth0-js (npm): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-6874 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-6874?

Check whether you run auth0-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-6874: Auth0 auth0-js Cross-Site Request Forgery in Legacy Lock API

CVE-2018-6874 · Severity: low · CVSS 3 · Published 2018-11-06

Auth0 is a widely used authentication service that handles user login for thousands of applications. A Cross-Site Request Forgery (CSRF) vulnerability in the auth0-js library could allow attackers to trick authenticated users into performing unwanted actions, such as changing account settings or granting permissions, without their knowledge or consent. This affects applications using the Legacy Lock API flag.

Technologies: auth0-js (npm). Vendors: npm.

Quick answers

Is CVE-2018-6874 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-6874 being exploited in the wild.
How severe is CVE-2018-6874?: Low severity, with a CVSS score of 3, published 6 November 2018.
Which products and versions are affected?: auth0-js (npm) SEMVER:introduced=0,fixed=9.0.0.
Is there a fix for CVE-2018-6874?: Yes. auth0-js (npm): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-6874 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-6874?: Check whether you run auth0-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

auth0-js (npm): upgrade to 9.0.0 or later
```
npm install auth0-js@9.0.0
```

Technical details

The vulnerability is a classic CSRF (CWE-352) in the Auth0 authentication service affecting auth0-js through version 14591, specifically when the Legacy Lock API flag is enabled. The attack requires user interaction (the victim must click a malicious link while authenticated) but no special privileges. An attacker can forge requests to perform actions on behalf of authenticated users. The vulnerability was patched in auth0-js version 9.0.0 and later. Detailed technical information is available in the Auth0 security bulletin CVE-2018-6874.

Affected products

Auth0 auth0-js before 9.0.0

Identifiers

CVE-2018-6874
GHSA-wv26-rj8c-4r33

Timeline

2018-11-06: disclosed
2018: patched: Fixed in auth0-js 9.0.0

References

https://auth0.com/docs/security/bulletins/cve-2018-6874

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.