Executive brief
react-adal is a JavaScript library used to integrate Azure Active Directory (AAD) authentication into React applications. A flaw in how nonce and session values are validated allows an attacker to forge a specially crafted JWT token that an application will incorrectly accept as authentic, potentially leading to unauthorized account access and data exposure.
Technical details
This vulnerability (CVE-2020-7787) is a logical authentication bypass in react-adal versions before 0.5.1. The root cause lies in how nonce, session, and refresh values are stored and validated in browser local/session storage. Each value is appended with || and stored as a pipe-separated list. Since || is always appended to the end, an empty string becomes a valid entry in the list. An attacker can craft a request with an empty session parameter and a JWT token containing an empty nonce value, causing the library to incorrectly validate it as authentic. The vulnerability is network-accessible and requires no user interaction or prior authentication. A fix was merged upstream in the ADAL.js library and is available in react-adal 0.5.1 and later.
Affected products
- <UNKNOWN> react-adal < 0.5.1
Timeline
- 2020-12-09: disclosed: Published on NVD
- 2020-12-14: patched: Fix merged in upstream ADAL.js and react-adal 0.5.1
- 2021-04-13: advisory: GitHub Advisory (GHSA-7mpx-vg3c-cmr4) published