CVE-2020-15125: Vulnerability in auth0 npm package
Summary
CVE-2020-15125: Authorization header is not sanitized in an error object in auth0. Affects auth0 versions < 2.27.1. Fixed in 2.27.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The auth0 npm package is a widely used library for authentication and authorization in Node.js applications. It provides a set of APIs and tools for integrating with Auth0, a popular identity management platform. The package allows developers to implement secure user authentication and authorization flows in their applications. However, versions before and including 2.27.0 of the auth0 package have a vulnerability that exposes the Authorization header value in error objects, potentially leaking bearer tokens. This vulnerability affects Machine to Machine applications authorized to use Auth0's management API.
Vulnerability Detail
The vulnerability in the auth0 npm package arises from the failure to sanitize the Authorization header in error objects. When a request to the Auth0 management API fails, the Authorization header value is not properly sanitized and can be logged, exposing the bearer token. This can lead to unauthorized access and potential misuse of the token. The vulnerability has a CVSS score of 7.7, indicating a high severity level.
How To Fix
Minimum fixed version
2.27.1
This is the first release that contains the fix.
npm install auth0@2.27.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the auth0 package.
Conclusion
The auth0 npm package has a vulnerability that exposes the Authorization header value in error objects, potentially leaking bearer tokens. To mitigate this vulnerability, it is recommended to upgrade to version 2.27.1 of the package. This upgrade will ensure the proper sanitization of the Authorization header and prevent unauthorized access. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for auth0 →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
The exposure of bearer tokens can lead to unauthorized access and potential misuse of user accounts and sensitive data. Attackers could impersonate authorized users, perform unauthorized actions, and gain access to confidential information.
There are no known exploits for this vulnerability at the moment. However, it is crucial to upgrade to the fixed version to mitigate the risk of potential attacks.
Yes, this vulnerability can be exploited remotely. Attackers can send malicious requests to the affected application and retrieve the exposed bearer tokens, allowing them to impersonate authorized users and perform unauthorized actions.
The fix provided in the patch will not impact end-users. However, it is essential to upgrade to the fixed version to ensure the security of user accounts and prevent potential unauthorized access.
