Executive brief
Auth0-js is a JavaScript library used by applications to integrate Auth0's authentication service. The library fails to properly validate CSRF tokens when the state parameter is missing from authorization responses, allowing attackers to perform unauthorized actions on behalf of authenticated users through cross-site request forgery attacks.
Technical details
The vulnerability is a CSRF bypass (CWE-352) in auth0-js versions prior to 9.3 where the state parameter validation is not enforced when the state is missing from the authorization response. An attacker can craft a malicious redirect that omits the state parameter, bypassing the client's CSRF protection check. The vulnerability requires user interaction (the user must click a malicious link or be redirected to an attacker-controlled site). By exploiting this, an attacker can execute unintended authentication flows and potentially gain unauthorized access to user accounts. The fix is available in version 9.3.0 and later.
Affected products
- Auth0 auth0-js below 9.3
Timeline
- 2018-03-07: disclosed
- 2018-03: patched: Fix released in version 9.3.0