Improper Validation of Query Parameters in Auth0 Next.js SDK - Potential OAuth Injection Risk
Summary
GHSA-mr6f-h57v-rpj5: Improper Validation of Query Parameters in Auth0 Next.js SDK. Affects @auth0/nextjs-auth0 versions >= 4.9.0, < 4.13.0. Fixed in 4.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Auth0 Next.js SDK is a library designed to facilitate authentication in Next.js applications using Auth0. It provides developers with tools to easily implement secure login and session management. However, versions of this SDK prior to 4.13.0 are susceptible to a vulnerability that allows improper validation of the 'returnTo' query parameter, potentially leading to unauthorized OAuth parameter injection.
Vulnerability Detail
The vulnerability arises from an input-validation flaw in the 'returnTo' parameter within the Auth0 Next.js SDK. This flaw allows attackers to inject unintended OAuth query parameters into the Auth0 authorization request. If exploited, this could result in tokens being issued with unintended parameters, which may compromise the security of the application and its users. The vulnerability is classified under CWE-184, indicating a lack of proper input validation.
How To Fix
Minimum fixed version
4.13.0
This is the first release that contains the fix.
npm install @auth0/nextjs-auth0@4.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to upgrade to the patched version of the SDK.
Conclusion
In summary, the Auth0 Next.js SDK has a vulnerability related to improper validation of query parameters, specifically the 'returnTo' parameter. It is crucial for developers using versions prior to 4.13.0 to upgrade to the latest version to mitigate potential security risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for @auth0/nextjs-auth0 →
FAQ
The vulnerability is an input-validation flaw that allows for the injection of unintended OAuth query parameters in the Auth0 Next.js SDK.
Versions of the Auth0 Next.js SDK from 4.9.0 to 4.12.9 are affected by this vulnerability.
If exploited, attackers could manipulate OAuth parameters, leading to the issuance of tokens with unintended parameters, which may compromise user security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application's vulnerability status using the Vulert playground without any signup.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @auth0/nextjs-auth0.
