Executive brief
Auth0 is a widely used authentication service that handles user login for thousands of applications. A Cross-Site Request Forgery (CSRF) vulnerability in the auth0-js library could allow attackers to trick authenticated users into performing unwanted actions, such as changing account settings or granting permissions, without their knowledge or consent. This affects applications using the Legacy Lock API flag.
Technical details
The vulnerability is a classic CSRF (CWE-352) in the Auth0 authentication service affecting auth0-js through version 14591, specifically when the Legacy Lock API flag is enabled. The attack requires user interaction (the victim must click a malicious link while authenticated) but no special privileges. An attacker can forge requests to perform actions on behalf of authenticated users. The vulnerability was patched in auth0-js version 9.0.0 and later. Detailed technical information is available in the Auth0 security bulletin CVE-2018-6874.
Affected products
- Auth0 auth0-js before 9.0.0
Timeline
- 2018-11-06: disclosed
- 2018: patched: Fixed in auth0-js 9.0.0