Executive brief
Auth0 Lock is a sign-up and login widget used by web applications to handle user authentication. Versions 11.20.4 and earlier do not properly sanitize HTML in the "placeholder" property when developers accept user input (such as from URL parameters) for custom sign-up fields. An attacker can exploit this to inject malicious scripts that execute in the browser of anyone signing up, potentially stealing credentials or session tokens.
Technical details
This is a cross-site scripting (XSS) vulnerability in the Auth0 Lock library's handling of the additionalSignUpFields customization option. When developers pass a placeholder property for a checkbox field that originates from untrusted input (e.g., URL query parameters), the library fails to sanitize HTML characters before rendering the value in the DOM. An attacker can craft a malicious URL containing JavaScript payload in the query parameter, which executes when the sign-up form is displayed. The vulnerability requires user interaction (visiting the crafted URL and viewing the sign-up page) and affects applications that specifically use additionalSignUpFields with a checkbox type and accept placeholder values from external sources. The vulnerability is fixed in version 11.21.0, which treats the placeholder property as plain text and introduces a new placeholderHTML property for cases where HTML content from trusted sources is intentionally required.
Affected products
- Auth0 Lock 11.20.4 and earlier
Timeline
- 2020-01-31: disclosed
- 2020-01-31: patched: Version 11.21.0 released with fix