Executive brief
Auth0 Passport-SharePoint is a Node.js authentication library used to integrate SharePoint login into applications. The library fails to validate JWT signatures on access tokens, allowing attackers to forge authentication tokens and bypass security controls without needing legitimate credentials. This enables unauthorized access to protected resources and can lead to account takeover or data exposure.
Technical details
Auth0 Passport-SharePoint versions prior to 0.4.0 fail to validate the cryptographic signature of JWT (JSON Web Token) access tokens during authentication processing. The vulnerability is classified as improper cryptographic validation (CWE-345). An attacker with network access can craft and present a forged JWT token to applications using the vulnerable library, and the token will be accepted without signature verification. No authentication or special privileges are required to exploit this—an attacker can simply submit a malicious token to bypass the entire authentication framework. The vulnerability was fixed in version 0.4.0 and later. The library is now deprecated and no longer maintained by Auth0.
Affected products
- Auth0 Passport-SharePoint before 0.4.0
Timeline
- 2019-07-25: disclosed: CVE-2019-13483 published
- 2019: patched: Fixed in version 0.4.0
- 2022-05-24: advisory: GHSA-45fh-g845-pj9w published