Homepage

auth0-lock@6.12.0 vulnerabilities

Auth0 Lock

  • latest version

    13.0.0

  • latest non vulnerable version

    13.0.0

  • first published

    10 years ago

  • latest version published

    29 days ago

  • licenses detected

  • View auth0-lock package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the auth0-lock package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cross-site Scripting (XSS)

    auth0-lock is a plugin for Auth0.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when the “additional signup fields” feature is configured, allowing a malicious actor to inject invalidated HTML code into these additional fields, which is then stored in the service user_metdata payload (using the name property).

    Verification emails, when applicable, are generated using this metadata. It is therefor possible for an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient's name within the delivered email template.

    How to fix Cross-site Scripting (XSS)?

    Upgrade auth0-lock to version 11.33.0 or higher.

    <11.33.0
    • H
    Cross-site Scripting (XSS)

    auth0-lock is a plugin for Auth0.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the flashMessage and languageDictionary features.

    How to fix Cross-site Scripting (XSS)?

    Upgrade auth0-lock to version 11.30.1 or higher.

    <11.30.1
    • L
    Cross-site Scripting (XSS)

    auth0-lock is a plugin for Auth0.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS). auth0-lock before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection.

    For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input. For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the lock widget opens.

    How to fix Cross-site Scripting (XSS)?

    Upgrade auth0-lock to version 11.26.3 or higher.

    <11.26.3
    • M
    Cross-site Scripting (XSS)

    auth0-lock is a plugin for Auth0.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It did not properly sanitize the generated HTML code.

    How to fix Cross-site Scripting (XSS)?

    Upgrade auth0-lock to version 11.21.0 or higher.

    <11.21.0
    • M
    Cross-site Request Forgery (CSRF)

    auth0-lock is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce.

    Affected versions of this package are vulnerable to Cross-Site Request Forgery (CSRF) attacks if the Legacy Lock API flag is enabled.

    Once the user credentials are verified, an HTML form is rendered into the user’s browser. A JSON Web Token (JWT) is POSTed to the /login/callback endpoint, and it maintains state regarding the identity of the user. Due to the lack of session binding, this form post is susceptible to CSRF. An attacker with valid user credentials at an Auth0 tenant can use them to gain such a form, and then employ techniques such as social engineering or clickjacking to have a victim’s browser execute it.

    How to fix Cross-site Request Forgery (CSRF)?

    Upgrade auth0-lock to version 11.0.0 or higher.

    <11.0.0
    Go back to all versions of this package