Executive brief
Auth0's Node.js SDK for managing authentication services uses a blocklist to sanitize sensitive data from error logs. However, the Authorization header (which contains bearer tokens) was not included in this blocklist. When an application using this SDK encounters an error calling Auth0's management API, the bearer token can be exposed in application logs or monitoring systems, potentially allowing attackers to impersonate the application and access customer authentication data.
Technical details
This is an information disclosure vulnerability (CWE-209) in the Auth0 Node.js SDK's error handling. The vulnerable component is the Auth0RestClient which catches failed API requests and logs the request object in error structures. The implementation uses a hardcoded blocklist of keys to sanitize (e.g., password, secret) but omitted "authorization". When a Management API request fails, the entire request object including the Authorization header and its bearer token value is retained in the error object, which can be logged or exposed in error monitoring systems. The attack requires an application to be using the SDK with Machine-to-Machine (client credentials) flow to access the management API. Exploitation occurs passively when API errors are logged; an attacker with access to logs or error tracking systems can extract the bearer token. The vulnerability was patched in version 2.27.1 by adding "authorization" and other headers to the sanitization blocklist.
Affected products
- Auth0 node-auth0 <=2.27.0
Timeline
- 2020-07-29: disclosed
- 2020-07-21: patched