NextAuth.js up to 3.29.4/4.4.x URL callbackUrl unusual condition

Summaryinfo

A vulnerability was found in NextAuth.js up to 3.29.4/4.4.x. It has been declared as problematic. This issue affects some unknown processing of the component URL Handler. The manipulation of the argument callbackUrl results in unusual condition. This vulnerability is identified as CVE-2022-31093. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in NextAuth.js up to 3.29.4/4.4.x (JavaScript Library). It has been classified as problematic. Affected is some unknown processing of the component URL Handler. The manipulation of the argument callbackUrl with an unknown input leads to a unusual condition vulnerability. CWE is classifying the issue as CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. This is going to have an impact on availability. CVE summarizes:

NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.

The weakness was released 06/28/2022 as GHSA-g5fm-jp9v-2432. The advisory is available at github.com. This vulnerability is traded as CVE-2022-31093 since 05/18/2022. Technical details are known, but there is no available exploit.

Upgrading to version 3.29.5 or 4.5.0 eliminates this vulnerability. Applying the patch 25517b73153332d948114bacdff3b5908de91d85 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• JavaScript Library

Name

• NextAuth.js

Version

• 3.29.0
• 3.29.1
• 3.29.2
• 3.29.3
• 3.29.4
• 4.0
• 4.1
• 4.2
• 4.3
• 4.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion