Is CVE-2019-20174 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-20174 being exploited in the wild.

How severe is CVE-2019-20174?

Low severity, with a CVSS score of 3.1, published 31 January 2020.

Which products and versions are affected?

Auth0 Lock 11.20.4 and earlier; auth0-lock (npm) SEMVER:introduced=0,fixed=11.21.0.

Is there a fix for CVE-2019-20174?

Yes. auth0-lock (npm): upgrade to 11.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-20174 attacked?

It is attacked over the network.

Am I affected by CVE-2019-20174?

Check whether you run Auth0 Lock or auth0-lock (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-20174: Auth0 Lock XSS in unsanitized placeholder property

CVE-2019-20174 · Severity: low · CVSS 3.1 · Published 2020-01-31

Auth0 Lock is a sign-up and login widget used by web applications to handle user authentication. Versions 11.20.4 and earlier do not properly sanitize HTML in the "placeholder" property when developers accept user input (such as from URL parameters) for custom sign-up fields. An attacker can exploit this to inject malicious scripts that execute in the browser of anyone signing up, potentially stealing credentials or session tokens.

Technologies: Auth0 Lock, auth0-lock (npm). Vendors: Auth0, npm.

Quick answers

Is CVE-2019-20174 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-20174 being exploited in the wild.
How severe is CVE-2019-20174?: Low severity, with a CVSS score of 3.1, published 31 January 2020.
Which products and versions are affected?: Auth0 Lock 11.20.4 and earlier; auth0-lock (npm) SEMVER:introduced=0,fixed=11.21.0.
Is there a fix for CVE-2019-20174?: Yes. auth0-lock (npm): upgrade to 11.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-20174 attacked?: It is attacked over the network.
Am I affected by CVE-2019-20174?: Check whether you run Auth0 Lock or auth0-lock (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

auth0-lock (npm): upgrade to 11.21.0 or later
```
npm install auth0-lock@11.21.0
```

Technical details

This is a cross-site scripting (XSS) vulnerability in the Auth0 Lock library's handling of the additionalSignUpFields customization option. When developers pass a placeholder property for a checkbox field that originates from untrusted input (e.g., URL query parameters), the library fails to sanitize HTML characters before rendering the value in the DOM. An attacker can craft a malicious URL containing JavaScript payload in the query parameter, which executes when the sign-up form is displayed. The vulnerability requires user interaction (visiting the crafted URL and viewing the sign-up page) and affects applications that specifically use additionalSignUpFields with a checkbox type and accept placeholder values from external sources. The vulnerability is fixed in version 11.21.0, which treats the placeholder property as plain text and introduces a new placeholderHTML property for cases where HTML content from trusted sources is intentionally required.

Affected products

Auth0 Lock 11.20.4 and earlier

Identifiers

CVE-2019-20174
GHSA-w2pf-g6r8-pg22

Timeline

2020-01-31: disclosed
2020-01-31: patched: Version 11.21.0 released with fix

References

https://github.com/auth0/lock/security/advisories/GHSA-w2pf-g6r8-pg22

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.