Missing proper state, nonce and PKCE checks for OAuth authentication
Résumé
Missing proper state, nonce and PKCE checks for OAuth authentication
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Impact
next-auth applications using OAuth provider versions before v4.20.1 are affected.
A bad actor who can spy on the victim's network or able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim, bypassing the CSRF protection.
As an example, an attack can happen in the following scenario.
TL;DR: The attacker steals the victim's authenticated callback by intercepting and tampering with the authorization URL created by
next-auth.
-
The victim attempts to log in to the
next-authsite. For example https://next-auth-example.vercel.app/ -
next-authsets thecheckscookies according to how the OAuth provider is configured. In this case,stateandpkceare set by default for the Google Provider. -
The attacker intercepts the returned authorization URL, strips away the OAuth check (nonce, state, pkce), and returns the URL without the check to the victim's browser. For example:
From
https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=client_id&scope=openid%20email%20profile&response_type=code&redirect_uri=https%3A%2F%2Fnext-auth-example.vercel.app%2Fapi%2Fauth%2Fcallback%2Fgoogle&state=state&code_challenge=code_challenge&code_challenge_method=S256&service=lso&o2v=2&flowName=GeneralOAuthFlow
to
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web authjs.dev
- web danielfett.de
- web github.com
- web next-auth.js.org
- web next-auth.js.org
- web security.netapp.com
- web rfc-editor.org