CVE-2021-32702: Reflected XSS in @auth0/nextjs-auth0

Background

The @auth0/nextjs-auth0 package is an npm package that provides authentication and authorization capabilities for Next.js applications. It allows developers to easily integrate Auth0 authentication into their Next.js projects. This package is vulnerable to a reflected cross-site scripting (XSS) attack, which can allow an attacker to execute arbitrary code by providing a malicious payload in the 'error' query parameter. The vulnerability exists in versions 1.4.1 and below of the package.

Vulnerability Detail

The vulnerability arises from the lack of proper input sanitization and validation in the callback handler of the @auth0/nextjs-auth0 package. When an error occurs during the authentication process, the error message is returned as part of the HTML response. However, this error message is not properly escaped, allowing an attacker to inject malicious code. By crafting a specially-crafted URL with a malicious payload in the 'error' query parameter, an attacker can trick a user into clicking the link and executing the injected code in their browser. This can lead to various consequences, including session hijacking, data theft, and unauthorized actions on behalf of the user.

npm install @auth0/nextjs-auth0@1.4.2

Workaround

If upgrading to version 1.4.2 is not immediately feasible, a temporary workaround can be implemented by manually sanitizing and escaping the error message in the callback handler. This can be done using a library or function that provides HTML escaping, such as 'he' or 'lodash.escape'. Here is an example of how to implement the workaround using the 'he' library:

const he = require('he');

// Callback handler
function handleCallback(req, res) {
  // Process error message
  const errorMessage = req.query.error;
  const sanitizedErrorMessage = he.escape(errorMessage);

  // Handle error
  // ...
}

Conclusion

The @auth0/nextjs-auth0 package is vulnerable to a reflected XSS attack that allows an attacker to execute arbitrary code by injecting a malicious payload in the 'error' query parameter. To mitigate this vulnerability, it is crucial to upgrade to version 1.4.2 of the package or implement the provided workaround. Failure to address this vulnerability can lead to serious security breaches and compromise the integrity of Next.js applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for @auth0/nextjs-auth0 →

FAQ