CVE-2020-7787: Improper Authentication in react-adal
Summary
CVE-2020-7787: Improper Authentication in react-adal. Affects react-adal versions < 0.5.1. Fixed in 0.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The react-adal package is an npm package used for integrating Azure Active Directory Authentication Library (ADAL) with React applications. It provides components and utilities for handling authentication and authorization processes. This vulnerability affects versions of react-adal prior to 0.5.1.
Vulnerability Detail
The vulnerability in react-adal allows for improper authentication due to a logical defect in how the nonce, session, and refresh values are stored and validated. When these values are stored in the browser's local storage or session storage, each key is automatically appended by '||'. However, an empty string ('') is always appended to the end of the list of values. This means that if an empty session parameter is provided in the callback URL and a specially-crafted JWT token contains an empty nonce value, the application will consider the JWT token as authentic. An attacker can exploit this to bypass authentication and gain unauthorized access to the application.
How To Fix
Minimum fixed version
0.5.1
This is the first release that contains the fix.
npm install react-adal@0.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the react-adal package to the fixed version.
Conclusion
The vulnerability in react-adal allows for improper authentication, potentially leading to unauthorized access and security breaches. It is crucial for developers to update their react-adal package to version 0.5.1 or higher to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for react-adal →
FAQ
React-adal is an npm package used for integrating Azure Active Directory Authentication Library (ADAL) with React applications. It provides components and utilities for handling authentication and authorization processes.
Versions of react-adal prior to 0.5.1 are affected by this vulnerability.
An attacker can exploit this vulnerability by providing an empty session parameter in the callback URL and crafting a JWT token with an empty nonce value. This will trick the application into considering the JWT token as authentic and bypassing the authentication process.
This vulnerability allows an attacker to bypass authentication and gain unauthorized access to the application. This can lead to unauthorized data access, privilege escalation, and other security breaches.
Yes, developers should update their react-adal package to version 0.5.1 or higher to fix this vulnerability.
