CVE-2022-31093: Improper Handling of `callbackUrl` parameter in next-auth

Background

The next-auth package is an authentication library for Next.js applications. It provides a simple and flexible way to implement authentication and authorization features. The package is widely used in the Next.js ecosystem and is known for its ease of use and robustness. However, a vulnerability has been discovered in versions before 3.29.5 (for v3 users) and before 4.5.0 (for v4 users) that allows an attacker to exploit the callbackUrl parameter, leading to API route handler timeouts and login failures.

Vulnerability Detail

The vulnerability arises from improper handling of the callbackUrl parameter in NextAuth.js. When an attacker sends a request with an invalid callbackUrl query parameter, the URL instantiation fails due to a malformed URL being passed into the constructor. This triggers an unhandled error, causing the API route handler to timeout and login to fail. The impact of this vulnerability can disrupt the authentication flow and potentially lead to unauthorized access or denial of service. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.

npm install next-auth@4.24.15

Workaround

If upgrading the next-auth package is not possible, a workaround can be implemented using advanced initialization. The code snippet below demonstrates the workaround:

import NextAuth from "next-auth"

function isValidHttpUrl(url) {
  try {
    return /^https?:///.test(url);
  } catch {
    return false;
  }
}

export default async function handler(req, res) {
  if (req.query.callbackUrl && !isValidHttpUrl(req.query.callbackUrl)) {
    return res.status(500).send('');
  }
  
  return await NextAuth(req, res, /* your config */)
}

This workaround checks if the callbackUrl query parameter is present and if it is a valid HTTP or HTTPS URL. If the callbackUrl is invalid, it returns a 500 status code, effectively preventing the vulnerability from being exploited.

Conclusion

The next-auth package is vulnerable to an improper handling of the callbackUrl parameter, which can lead to API route handler timeouts and login failures. To mitigate this vulnerability, it is recommended to update to the latest patched version of the package. If upgrading is not possible, a workaround using advanced initialization is available. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for next-auth →

FAQ