Is CVE-2022-29172 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-29172 being exploited in the wild.

How severe is CVE-2022-29172?

Low severity, with a CVSS score of 3.1, published 24 May 2022.

Which products and versions are affected?

Auth0 Lock 11.32.2 and earlier; auth0-lock (npm) SEMVER:introduced=0,fixed=11.33.0.

Is there a fix for CVE-2022-29172?

Yes. auth0-lock (npm): upgrade to 11.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-29172 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-29172?

Check whether you run Auth0 Lock or auth0-lock (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-29172: Auth0 Lock cross-site scripting via additional signup fields

CVE-2022-29172 · Severity: low · CVSS 3.1 · Published 2022-05-24

Auth0 Lock is a widely-used authentication UI widget used by applications to handle user sign-up and login. When the "additional signup fields" feature is enabled, malicious users can inject unvalidated HTML code that gets stored in user metadata and rendered in verification emails, potentially allowing attackers to send phishing emails or trick users into clicking malicious links that appear to come from legitimate sources.

Technologies: Auth0 Lock, auth0-lock (npm). Vendors: Auth0, npm.

Quick answers

Is CVE-2022-29172 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-29172 being exploited in the wild.
How severe is CVE-2022-29172?: Low severity, with a CVSS score of 3.1, published 24 May 2022.
Which products and versions are affected?: Auth0 Lock 11.32.2 and earlier; auth0-lock (npm) SEMVER:introduced=0,fixed=11.33.0.
Is there a fix for CVE-2022-29172?: Yes. auth0-lock (npm): upgrade to 11.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-29172 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-29172?: Check whether you run Auth0 Lock or auth0-lock (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

auth0-lock (npm): upgrade to 11.33.0 or later
```
npm install auth0-lock@11.33.0
```

Technical details

This is a cross-site scripting (CWE-79) vulnerability in the additional signup fields feature of Auth0 Lock. The vulnerability exists because user input provided in additional signup fields is not properly sanitized before being stored in the service's user_metadata payload. When verification emails are generated, this unsanitized metadata (specifically the name property) is rendered directly into the email template without HTML escaping. An attacker can craft a malicious signup request injecting HTML/JavaScript into these fields, which is then delivered to victims via email, potentially enabling phishing attacks or credential theft. The fix, released in version 11.33.0, strips HTML tags from user input in additional signup fields on the signup tab.

Affected products

Auth0 Lock 11.32.2 and earlier

Identifiers

CVE-2022-29172
GHSA-7ww6-75fj-jcj7

Timeline

2022-05-05: disclosed
2022-05-24: advisory
2022-05-24: patched: Version 11.33.0 released

References

https://github.com/auth0/lock/security/advisories/GHSA-7ww6-75fj-jcj7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.