Auth0 Next.js SDK Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Auth0 Next.js SDK, specifically in versions prior to and including 1.4.1. The issue arises in the callback handler, where an XSS payload can be injected through the 'error' query parameter. This payload is then processed as an error message, allowing an attacker to execute arbitrary code. Users of the SDK are affected unless they have implemented custom error handling that excludes the error message from being returned in an HTML response.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, use the Auth0 Next.js SDK version 1.4.1 or lower. Navigate to the callback URL of the application and include an XSS payload in the 'error' query parameter. The injected script will be executed, demonstrating the cross-site scripting vulnerability.

Remediation

Upgrade to Auth0 Next.js SDK version 1.4.2 or later, where this vulnerability has been patched by adding basic HTML escaping to the error message. Users should ensure that any custom error handling also properly escapes error messages before rendering.