Quick answers
- Is CVE-2021-32641 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-32641 being exploited in the wild.
- How severe is CVE-2021-32641?
- Low severity, with a CVSS score of 3.1, published 4 June 2021.
- Which products and versions are affected?
- Auth0 Lock <=11.30.0; auth0-lock (npm) SEMVER:introduced=0,fixed=11.30.1.
- Is there a fix for CVE-2021-32641?
- Yes. auth0-lock (npm): upgrade to 11.30.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-32641 attacked?
- It is attacked over the network.
- Am I affected by CVE-2021-32641?
- Check whether you run Auth0 Lock or auth0-lock (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- auth0-lock (npm): upgrade to 11.30.1 or later
npm install auth0-lock@11.30.1
Technical details
The vulnerability is a reflected XSS (CWE-79) affecting the auth0-lock library up to version 11.30.0. The root cause is insufficient input validation and encoding in the flashMessage and languageDictionary features, which directly incorporate user-supplied data or URL parameters into the DOM without sanitization. Attack vector is network-based with no authentication required; an attacker sends a victim a crafted URL containing malicious JavaScript payload. Precondition: the application must use flashMessage or languageDictionary features and pass unsanitized user input or query parameters to these features. An attacker can execute arbitrary JavaScript in the victim's browser context. The vulnerability is patched in version 11.30.1, which uses DOMPurify to sanitize inputs.
Affected products
- Auth0 Lock <=11.30.0
Identifiers
- CVE-2021-32641
- GHSA-jr3j-whm4-9wwm
Timeline
- 2021-06-04: disclosed
- 2021-06-04: patched: Version 11.30.1 released with DOMPurify sanitization