GHSA-XV97-C62V-4587

Vulnerability from github – Published: 2022-08-02 18:00 – Updated: 2022-08-11 22:13
VLAI?
Summary
NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails
Details

Impact

next-auth users who are using the EmailProvider either in versions before 4.10.3 or 3.29.10 are affected.

If an attacker could forge a request that sent a comma-separated list of emails (eg.: attacker@attacker.com,victim@victim.com) to the sign-in endpoint, NextAuth.js would send emails to both the attacker and the victim's e-mail addresses. The attacker could then login as a newly created user with the email being attacker@attacker.com,victim@victim.com. This means that basic authorization like email.endsWith("@victim.com") in the signIn callback would fail to communicate a threat to the developer and would let the attacker bypass authorization, even with an @attacker.com address.

Patches

We patched this vulnerability in v4.10.3 and v3.29.10 by normalizing the email value that is sent to the sign-in endpoint before accessing it anywhere else. We also added a normalizeIdentifier callback on the EmailProvider configuration, where you can further tweak your requirements for what your system considers a valid e-mail address. (E.g.: strict RFC2821 compliance)

To upgrade, run one of the following:

npm i next-auth@latest

yarn add next-auth@latest

pnpm add next-auth@latest

(This will update to the latest v4 version, but you can change latest to 3 if you want to stay on v3. This is not recommended. v3 is unmaintained.)

Workarounds

If for some reason you cannot upgrade, you can normalize the incoming request like the following, using Advanced Initialization:

// pages/api/auth/[...nextauth].ts

function normalize(identifier) {
  // Get the first two elements only,
  // separated by `@` from user input.
  let [local, domain] = identifier.toLowerCase().trim().split("@")
  // The part before "@" can contain a ","
  // but we remove it on the domain part
  domain = domain.split(",")[0]
  return `${local}@${domain}`
}

export default async function handler(req, res) {
  if (req.body.email) req.body.email = normalize(req.body.email)
  return await NextAuth(req, res, {/* your options */ })
}

References

  • EmailProvider: https://next-auth.js.org/providers/email
  • Normalize the email address: https://next-auth.js.org/providers/email#normalizing-the-email-address
  • Email syntax: https://en.wikipedia.org/wiki/Email_address#Local-part
  • signIn callback: https://next-auth.js.org/configuration/callbacks#sign-in-callback
  • Advanced Initialization: https://next-auth.js.org/configuration/initialization#advanced-initialization
  • nodemailer address: https://nodemailer.com/message/addresses

For more information

If you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability

Timeline

The issue was reported 26th of July, a response was sent out in less than 1 hour and after identifying the issue a patch was published within 5 working days.

Acknowledgments

We would like to thank Socket for disclosing this vulnerability in a responsible manner and following up until it got published.

Severity ?
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "next-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "next-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.29.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-35924"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-02T18:00:33Z",
    "nvd_published_at": "2022-08-02T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n`next-auth` users who are using the `EmailProvider` either in versions before `4.10.3` or `3.29.10` are affected.\n\nIf an attacker could forge a request that sent a comma-separated list of emails (eg.: `attacker@attacker.com,victim@victim.com`) to the sign-in endpoint, NextAuth.js would send emails to both the attacker and the victim\u0027s e-mail addresses. The attacker could then login as a newly created user with the email being `attacker@attacker.com,victim@victim.com`. This means that basic authorization like `email.endsWith(\"@victim.com\")` in the `signIn` callback would fail to communicate a threat to the developer and would let the attacker bypass authorization, even with an `@attacker.com` address.\n\n### Patches\nWe patched this vulnerability in `v4.10.3` and `v3.29.10` by normalizing the email value that is sent to the sign-in endpoint before accessing it anywhere else. We also added a `normalizeIdentifier` callback on the `EmailProvider` configuration, where you can further tweak your requirements for what your system considers a valid e-mail address. (E.g.: strict RFC2821 compliance)\n\nTo upgrade, run one of the following:\n```sh\nnpm i next-auth@latest\n```\n```sh\nyarn add next-auth@latest\n```\n```sh\npnpm add next-auth@latest\n```\n\n(This will update to the latest v4 version, but you can change `latest` to `3` if you want to stay on v3. This is not recommended. v3 is unmaintained.)\n\n### Workarounds\nIf for some reason you cannot upgrade, you can normalize the incoming request like the following, using Advanced Initialization:\n```ts\n// pages/api/auth/[...nextauth].ts\n\nfunction normalize(identifier) {\n  // Get the first two elements only,\n  // separated by `@` from user input.\n  let [local, domain] = identifier.toLowerCase().trim().split(\"@\")\n  // The part before \"@\" can contain a \",\"\n  // but we remove it on the domain part\n  domain = domain.split(\",\")[0]\n  return `${local}@${domain}`\n}\n\nexport default async function handler(req, res) {\n  if (req.body.email) req.body.email = normalize(req.body.email)\n  return await NextAuth(req, res, {/* your options */ })\n}\n```\n\n### References\n- EmailProvider: https://next-auth.js.org/providers/email\n- Normalize the email address: https://next-auth.js.org/providers/email#normalizing-the-email-address\n- Email syntax: https://en.wikipedia.org/wiki/Email_address#Local-part\n- `signIn` callback: https://next-auth.js.org/configuration/callbacks#sign-in-callback\n- Advanced Initialization: https://next-auth.js.org/configuration/initialization#advanced-initialization\n- `nodemailer` address: https://nodemailer.com/message/addresses\n\n### For more information\n\nIf you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability\n\n### Timeline\n\nThe issue was reported 26th of July, a response was sent out in less than 1 hour and after identifying the issue a patch was published within 5 working days.\n\n### Acknowledgments\n\nWe would like to thank [Socket](https://socket.dev) for disclosing this vulnerability in a responsible manner and following up until it got published.",
  "id": "GHSA-xv97-c62v-4587",
  "modified": "2022-08-11T22:13:10Z",
  "published": "2022-08-02T18:00:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xv97-c62v-4587"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35924"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nextauthjs/next-auth/commit/afb1fcdae3cc30445038ef588e491d139b916003"
    },
    {
      "type": "WEB",
      "url": "https://en.wikipedia.org/wiki/Email_address#Local-part"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nextauthjs/next-auth"
    },
    {
      "type": "WEB",
      "url": "https://next-auth.js.org/configuration/callbacks#sign-in-callback"
    },
    {
      "type": "WEB",
      "url": "https://next-auth.js.org/configuration/initialization#advanced-initialization"
    },
    {
      "type": "WEB",
      "url": "https://next-auth.js.org/providers/email"
    },
    {
      "type": "WEB",
      "url": "https://next-auth.js.org/providers/email#normalizing-the-e-mail-address"
    },
    {
      "type": "WEB",
      "url": "https://next-auth.js.org/providers/email#normalizing-the-email-address"
    },
    {
      "type": "WEB",
      "url": "https://nodemailer.com/message/addresses"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.