CVE-2022-29172: Cross-site Scripting in Auth0 Lock
Summary
CVE-2022-29172: Cross-site Scripting in Auth0 Lock. Affects auth0-lock versions < 11.33.0. Fixed in 11.33.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Auth0 Lock is an npm package that provides a customizable login and signup experience for applications. It allows developers to easily integrate authentication and authorization functionality into their applications. The package includes features such as social login, multi-factor authentication, and customizable signup fields. However, versions before and including 11.32.2 are vulnerable to a cross-site scripting (XSS) attack when the 'additional signup fields' feature is configured. This vulnerability allows a malicious actor to inject HTML code into the additional fields, which is then stored in the user_metadata payload. Verification emails generated using this metadata can contain malicious links crafted by the attacker.
Vulnerability Detail
The vulnerability arises from the lack of HTML validation on the additional signup fields in Auth0 Lock. When a user enters HTML code into these fields, it is not properly sanitized and is stored in the user_metadata payload. This payload is then used to generate verification emails, potentially leading to the execution of arbitrary HTML and JavaScript code in the context of the recipient's email client. This can result in various attacks, including phishing, session hijacking, and the theft of sensitive information. The impact of this vulnerability is moderate, with a CVSS score of 6.1.
How To Fix
Minimum fixed version
11.33.0
This is the first release that contains the fix.
npm install auth0-lock@11.33.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the auth0-lock package as soon as possible.
Conclusion
In conclusion, the Auth0 Lock package versions before and including 11.32.2 are vulnerable to a cross-site scripting attack when the 'additional signup fields' feature is configured. To mitigate this vulnerability, it is crucial to upgrade to version 11.33.0 or higher. This upgrade ensures that user input is properly sanitized and prevents the injection of malicious code. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for auth0-lock →
FAQ
You are impacted by this vulnerability if you are using auth0-lock version 11.32.2 or lower and have configured the 'additional signup fields' feature in your application.
The impact of this vulnerability is moderate. It allows an attacker to inject arbitrary HTML and JavaScript code into verification emails, potentially leading to various attacks such as phishing, session hijacking, and information theft.
To fix this vulnerability, upgrade to version 11.33.0 or higher of the auth0-lock package. This version includes HTML tag stripping for additional signup fields, preventing the injection of malicious code.
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the auth0-lock package to mitigate the risk.
You can find more information about this vulnerability in the GitHub Security Advisory GHSA-7ww6-75fj-jcj7.
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0-lock.
