CVE-2022-29172 HTML injection with additional signup fields
Attackers can inject HTML into signup fields to execute scripts in verification emails, affecting Auth0 Lock users with additional signup fields enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-29172?
CVE-2022-29172 is a medium-severity cross-site scripting vulnerability in auth0 lock, published on 5 May 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the “additional signup fields” feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (using the `name` property). Verification emails, when applicable, are generated using this metadata. It is therefor possible for an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient's name within the delivered email template. You are impacted by this vulnerability if you are using `auth0-lock` version `11.32.2` or lower and are using the “additional signup fields” feature in your application. Upgrade to version `11.33.0`.
Weakness: CWE-79
Which versions are affected by CVE-2022-29172?
2 open source packages ship an affected version, including auth0-lock. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
auth0-lock npm | All versions | 11.33.0 |
auth0-lock npm | All versions | 11.33.0 |
Products include Auth0 Lock.
How do I fix CVE-2022-29172?
Upgrade auth0-lock to 11.33.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-29172 being exploited?
There is no known exploitation of CVE-2022-29172 in the wild and no public exploit code.
Other vulnerabilities in auth0 lock
Sources
Also known as GHSA-7ww6-75fj-jcj7.