GHSA-954c-jjx6-cxv7

Source

https://github.com/advisories/GHSA-954c-jjx6-cxv7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-954c-jjx6-cxv7/GHSA-954c-jjx6-cxv7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-954c-jjx6-cxv7

Aliases

CVE-2021-32702

Related

CVE-2021-32702

Published

2021-06-28T16:46:41Z

Modified

2023-11-08T04:05:57.418854Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Reflected XSS from the callback handler's error query parameter

Details

Overview

Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the callback handler as an error message.

Am I affected?

You are affected by this vulnerability if you are using @auth0/nextjs-auth0 version 1.4.1 or lower unless you are using custom error handling that does not return the error message in an HTML response.

How to fix that?

Upgrade to version 1.4.2.

Will this update impact my users?

The fix adds basic HTML escaping to the error message and it should not impact your users.

Credit

https://github.com/inian https://github.com/git-ishanpatel

Database specific

{
    "nvd_published_at": "2021-06-25T17:15:00Z",
    "github_reviewed_at": "2021-06-25T15:38:26Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

npm / @auth0/nextjs-auth0

Package

Name: @auth0/nextjs-auth0; View open source insights on deps.dev
Purl: pkg:npm/%40auth0/nextjs-auth0

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.2