Executive brief
The Auth0 SDK for Next.js, which handles user logins for web applications, contains a security flaw that allows for open redirects. An attacker can trick users into visiting a legitimate-looking login link that, upon successful authentication, redirects them to a malicious external website. This can be used in phishing campaigns to steal user credentials or distribute malware by exploiting the user's trust in the original application.
Technical details
An open redirect vulnerability (CWE-601) exists in @auth0/nextjs-auth0 versions prior to 1.6.2. The library fails to properly validate or filter the 'returnTo' parameter provided in the login URL, allowing an attacker to supply an arbitrary external URL. While the CVSS provided by the vendor suggests low privilege (PR:L) may be involved, open redirects typically involve unauthenticated users being redirected after a login flow. An attacker can craft a link that redirects a victim to a malicious site after they authenticate with the legitimate service. The issue was resolved in version 1.6.2 by enforcing that the redirect host matches the configured application host.
Affected products
- Auth0 @auth0/nextjs-auth0 <= 1.6.1
Timeline
- 2021-12-16: advisory: GitHub Security Advisory published
- 2021-12-16: patched: Version 1.6.2 released to address the vulnerability