Executive brief
Auth0 Lock is a UI widget used to authenticate users in web applications. Versions up to 11.25.1 fail to properly sanitize user input when displaying messages in Passwordless or Enterprise connection modes, allowing attackers to inject malicious JavaScript that executes in the context of the user's browser. This could lead to account takeover, credential theft, or other session hijacking attacks.
Technical details
The vulnerability is a DOM-based cross-site scripting (XSS) flaw caused by the use of dangerouslySetInnerHTML to render user-supplied input without proper encoding. In Passwordless mode, the email or phone number entered by a user is displayed back during verification code input. In Enterprise mode, the IdP Domain from the Auth0 Dashboard configuration is displayed when the lock widget opens. Both code paths fail to escape HTML entities, allowing an attacker to inject XSS payloads via these input vectors. An attacker with ability to control these values (e.g., via compromised Auth0 Dashboard or crafted Passwordless input) can execute arbitrary JavaScript in the victim's browser within the application context. The fix was released in version 11.26.3.
Affected products
- Auth0 auth0-lock <= 11.25.1
Timeline
- 2020-08-19: disclosed
- 2020-08-19: patched: Version 11.26.3 released