Executive brief
Auth0's nextjs-auth0 is a library that handles OAuth authentication for Next.js web applications. A reflected cross-site scripting (XSS) vulnerability in the callback handler allows attackers to inject malicious scripts via the error query parameter, which could be used to steal session tokens, redirect users to phishing sites, or perform actions on behalf of authenticated users.
Technical details
This is a reflected XSS vulnerability (CWE-79) in the callback handler of @auth0/nextjs-auth0 versions 1.4.1 and earlier. An attacker can inject arbitrary JavaScript by crafting a URL with an XSS payload in the error query parameter; this error message is then rendered in the HTML response without proper escaping. The vulnerability requires user interaction (clicking a malicious link) but no authentication is required. An attacker can achieve arbitrary script execution in the victim's browser context. The fix was released in version 1.4.2, which adds HTML escaping to error messages.
Affected products
- Auth0 nextjs-auth0 <=1.4.1
Timeline
- 2021-06-25: disclosed
- 2021-06-28: patched: Version 1.4.2 released with HTML escaping fix