CVE-2022-31127 Improper handling of email input in next-auth
Attackers can inject malicious HTML into verification emails via the email input, enabling phishing attacks against users of NextAuth.js.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-31127?
CVE-2022-31127 is a high-severity cross-site scripting vulnerability in nextauthjs next-auth, published on 6 Jul 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail [signin endpoint](https://next-auth.js.org/getting-started/rest-api#post-apiauthsigninprovider) that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.: `[email protected], <a href="http://attacker.com">Before signing in, claim your money!</a>`. This was previously sent to `[email protected]`, and the content of the email containing a link to the attacker's site was rendered in the HTML. This has been remedied in the following releases, by simply not rendering that e-mail in the HTML, since it should be obvious to the receiver what e-mail they used: next-auth v3 users before version 3.29.8 are impacted. (We recommend upgrading to v4, as v3 is considered unmaintained. next-auth v4 users before version 4.9.0 are impacted. If for some reason you cannot upgrade, the workaround requires you to sanitize the `email` parameter that is passed to `sendVerificationRequest` and rendered in the HTML. If you haven't created a custom `sendVerificationRequest`, you only need to upgrade. Otherwise, make sure to either exclude `email` from the HTML body or efficiently sanitize it.
Weakness: CWE-79
Which versions are affected by CVE-2022-31127?
4 open source packages ship an affected version, including next-auth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next-auth npm | All versions | 3.29.8 |
next-auth npm | All versions | 3.29.8 |
next-auth npm | From 4.0.0 | 4.9.0 |
next-auth npm | From 4.0.0 | 4.9.0 |
Products include Nextauth.js Next-Auth.
How do I fix CVE-2022-31127?
Upgrade next-auth to a fixed version for your release line: 3.29.8 or 4.9.0.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-31127 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31127 exists.
Other vulnerabilities in nextauthjs next-auth
- CVE-2022-35924 Verification requests (magic link) sent to unwanted emails
- CVE-2023-27490 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth
- CVE-2022-31093 Improper Handling of `callbackUrl` parameter in next-auth
- CVE-2022-39263 NextAuth.js Upstash Adapter missing token verification
- CVE-2022-29214 URL Redirection to Untrusted Site ('Open Redirect') in next-auth
Sources
Also known as GHSA-pgjx-7f9g-9463.