NextAuth.js up to 3.29.8/4.10.1 log file

Summaryinfo

A vulnerability was found in NextAuth.js up to 3.29.8/4.10.1. It has been classified as problematic. Impacted is an unknown function. This manipulation causes log file. This vulnerability is handled as CVE-2022-31186. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in NextAuth.js up to 3.29.8/4.10.1 (JavaScript Library). It has been declared as problematic. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a log file vulnerability. The CWE definition for the vulnerability is CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. As an impact it is known to affect confidentiality. The summary by CVE is:

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.

The weakness was released 08/02/2022 as GHSA-p6mm-27gq-9v3p. The advisory is shared at github.com. This vulnerability is known as CVE-2022-31186 since 05/18/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 3.29.9 or 4.10.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• JavaScript Library

Name

• NextAuth.js

Version

• 3.29.0
• 3.29.1
• 3.29.2
• 3.29.3
• 3.29.4
• 3.29.5
• 3.29.6
• 3.29.7
• 3.29.8
• 4.10.0
• 4.10.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion