CVE-2018-15121 Auth0-ASPNET and Auth0-ASPNET-Owin vulnerable to Cross-Site Request Forgery
Attackers can perform CSRF attacks during authentication because the library fails to validate the OAuth state parameter, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-15121?
CVE-2018-15121 is a high-severity vulnerability in n/a, published on 29 Aug 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
Weakness: CWE-352
Which versions are affected by CVE-2018-15121?
4 open source packages ship an affected version, including Auth0-ASPNET-Owin and auth0-aspnet. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
Auth0-ASPNET-Owin NuGet | All versions to 2.3.2 | None |
Auth0-ASPNET-Owin NuGet | All versions to 2.3.2 | None |
auth0-aspnet NuGet | All versions to 2.1.1 | None |
auth0-aspnet NuGet | All versions to 2.1.1 | None |
Products include Auth0 Aspnet, Auth0 Aspnet-Owin.
How do I fix CVE-2018-15121?
No fix has been published for CVE-2018-15121 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-15121 being exploited?
There is no known exploitation of CVE-2018-15121 in the wild and no public exploit code.
Sources
Also known as GHSA-mmhr-3jr7-qj2p.