Is CVE-2020-15119 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-15119 being exploited in the wild.

How severe is CVE-2020-15119?

Low severity, with a CVSS score of 3.1, published 19 August 2020.

Which products and versions are affected?

auth0-lock (npm) SEMVER:introduced=0,fixed=11.26.3.

Is there a fix for CVE-2020-15119?

Yes. auth0-lock (npm): upgrade to 11.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-15119 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-15119?

Check whether you run auth0-lock (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-15119: Auth0 auth0-lock DOM-based XSS in Passwordless and Enterprise connections

CVE-2020-15119 · Severity: low · CVSS 3.1 · Published 2020-08-19

Auth0 Lock is a UI widget used to authenticate users in web applications. Versions up to 11.25.1 fail to properly sanitize user input when displaying messages in Passwordless or Enterprise connection modes, allowing attackers to inject malicious JavaScript that executes in the context of the user's browser. This could lead to account takeover, credential theft, or other session hijacking attacks.

Technologies: auth0-lock (npm). Vendors: npm.

Quick answers

Is CVE-2020-15119 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-15119 being exploited in the wild.
How severe is CVE-2020-15119?: Low severity, with a CVSS score of 3.1, published 19 August 2020.
Which products and versions are affected?: auth0-lock (npm) SEMVER:introduced=0,fixed=11.26.3.
Is there a fix for CVE-2020-15119?: Yes. auth0-lock (npm): upgrade to 11.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-15119 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-15119?: Check whether you run auth0-lock (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

auth0-lock (npm): upgrade to 11.26.3 or later
```
npm install auth0-lock@11.26.3
```

Technical details

The vulnerability is a DOM-based cross-site scripting (XSS) flaw caused by the use of dangerouslySetInnerHTML to render user-supplied input without proper encoding. In Passwordless mode, the email or phone number entered by a user is displayed back during verification code input. In Enterprise mode, the IdP Domain from the Auth0 Dashboard configuration is displayed when the lock widget opens. Both code paths fail to escape HTML entities, allowing an attacker to inject XSS payloads via these input vectors. An attacker with ability to control these values (e.g., via compromised Auth0 Dashboard or crafted Passwordless input) can execute arbitrary JavaScript in the victim's browser within the application context. The fix was released in version 11.26.3.

Affected products

Auth0 auth0-lock <= 11.25.1

Identifiers

CVE-2020-15119
GHSA-6gg3-pmm7-97xc

Timeline

2020-08-19: disclosed
2020-08-19: patched: Version 11.26.3 released

References

https://github.com/auth0/lock/security/advisories/GHSA-6gg3-pmm7-97xc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.