GHSA-g6f5-4w43-2x63 ScnSocialAuth Cross-site Scripting vulnerability in login redirect param
Attackers can inject malicious scripts via the redirect parameter, potentially hijacking user sessions or defacing the login page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-g6f5-4w43-2x63?
GHSA-g6f5-4w43-2x63 is a cross-site scripting vulnerability in socalnick/scn-social-auth, published on 29 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
ScnSocialAuth version 1.15.2 has been released and includes a security for this vulnerability. Fix has been applied in https://github.com/SocalNick/ScnSocialAuth/commit/4a00966c41bc37251586d007564c5c891eba3700
Affected versions
All versions below 1.15.2 are affected. dev-master is fixed starting from https://github.com/SocalNick/ScnSocialAuth/commit/4a00966c41bc37251586d007564c5c891eba3700
Exploits
Because of missing escaping of the URL param redirect a XSS attack is possible.
For example: Setting the redirect param to "><a%20href="http://github.com">GitHub.com</a><inpu%20type="hidden"%20" would result in a link added to the login page.
Resolution
If you are using any version of ScnSocialAuth below 1.15.2 please upgrade immediately by running composer update.
Which versions are affected by GHSA-g6f5-4w43-2x63?
2 open source packages ship an affected version, including socalnick/scn-social-auth.
| Package | Affected | Fixed in |
|---|---|---|
socalnick/scn-social-auth Packagist | All versions | 1.15.2 |
socalnick/scn-social-auth Packagist | All versions | 1.15.2 |
How do I fix GHSA-g6f5-4w43-2x63?
Upgrade socalnick/scn-social-auth to 1.15.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-g6f5-4w43-2x63 being exploited?
There is no known exploitation of GHSA-g6f5-4w43-2x63 in the wild and no public exploit code.