Executive brief
The @keystone-6/auth package, which handles authentication for the Keystone CMS administration interface, contains a reflected cross-site scripting (XSS) vulnerability in the signin and init pages. An attacker can craft a malicious link that executes arbitrary JavaScript in an admin's browser when visited, potentially leading to account compromise or data theft through phishing attacks.
Technical details
A reflected cross-site scripting (CWE-79) vulnerability exists in the @keystone-6/auth authentication library, affecting the signin and init pages. The vulnerability stems from improper neutralization of user-controllable input before it is reflected in the web page output served to other users. An attacker can craft a malicious URL containing unsanitized query parameters that execute arbitrary JavaScript in the victim's browser when clicked. User interaction (clicking the link) is required, and the attack typically targets administrative users through phishing. The vulnerability was patched in @keystone-6/auth version 1.0.2; users of the legacy @keystone-next/auth package are advised to upgrade to @keystone-6.
Affected products
- Keystonejs @keystone-6/auth < 1.0.2
- Keystonejs @keystone-next/auth <= 37.0.0
Timeline
- 2022-01-10: disclosed
- 2022-01-12: patched: @keystone-6/auth 1.0.2