CVE-2021-32702: Auth0 nextjs-auth0 reflected XSS in callback handler

CVE-2021-32702 · Severity: low · CVSS 3.1 · Published 2021-06-28

Auth0's nextjs-auth0 is a library that handles OAuth authentication for Next.js web applications. A reflected cross-site scripting (XSS) vulnerability in the callback handler allows attackers to inject malicious scripts via the error query parameter, which could be used to steal session tokens, redirect users to phishing sites, or perform actions on behalf of authenticated users.

Technologies: Auth0 Nextjs-Auth0, @auth0/nextjs-auth0 (npm). Vendors: Auth0, npm.

Quick answers

Is CVE-2021-32702 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-32702 being exploited in the wild.
How severe is CVE-2021-32702?
Low severity, with a CVSS score of 3.1, published 28 June 2021.
Which products and versions are affected?
Auth0 Nextjs-Auth0 <=1.4.1; @auth0/nextjs-auth0 (npm) SEMVER:introduced=0,fixed=1.4.2.
Is there a fix for CVE-2021-32702?
Yes. @auth0/nextjs-auth0 (npm): upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-32702 attacked?
It is attacked over the network.
Am I affected by CVE-2021-32702?
Check whether you run Auth0 Nextjs-Auth0 or @auth0/nextjs-auth0 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @auth0/nextjs-auth0 (npm): upgrade to 1.4.2 or later
    npm install @auth0/nextjs-auth0@1.4.2

Technical details

This is a reflected XSS vulnerability (CWE-79) in the callback handler of @auth0/nextjs-auth0 versions 1.4.1 and earlier. An attacker can inject arbitrary JavaScript by crafting a URL with an XSS payload in the error query parameter; this error message is then rendered in the HTML response without proper escaping. The vulnerability requires user interaction (clicking a malicious link) but no authentication is required. An attacker can achieve arbitrary script execution in the victim's browser context. The fix was released in version 1.4.2, which adds HTML escaping to error messages.

Affected products

  • Auth0 nextjs-auth0 <=1.4.1

Identifiers

  • CVE-2021-32702
  • GHSA-954c-jjx6-cxv7

Timeline

  • 2021-06-25: disclosed
  • 2021-06-28: patched: Version 1.4.2 released with HTML escaping fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.