GitHub Advisoryadvisory · npm
GHSA-954c-jjx6-cxv7 Reflected XSS from the callback handler's error query parameter
HIGH
Official page ↗
- Aliases
- CVE-2021-32702
- Ecosystem
- npm
- Packages
- @auth0/nextjs-auth0
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2021-06-25
Affected packages
• npm @auth0/nextjs-auth0: < 1.4.2 → fixed in 1.4.2
Description
Overview
Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message.
Am I affected?
You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower unless you are using custom error handling that does not return the error message in an HTML response.
How to fix that?
Upgrade to version `1.4.2`.
Will this update impact my users?
The fix adds basic HTML escaping to the error message and it should not impact your users.
Credit
https://github.com/inian
https://github.com/git-ishanpatel
Related
Alias · CVE (1)
- CVE-2021-32702 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness