CVE-2022-24858 - OpenCVE

next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Nextauth.js	Next-auth

Configuration 1 [-]

OR	cpe:2.3:a:nextauth.js:next-auth::::::node.js::*
	cpe:2.3:a:nextauth.js:next-auth::::::node.js::*

No data.

References

Link	Providers
https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw
https://next-auth.js.org/configuration/callbacks#redirect-callback
https://next-auth.js.org/getting-started/upgrade-v4

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-04-19T22:25:10

Updated: 2024-08-03T04:20:50.660Z

Reserved: 2022-02-10T00:00:00

Link: CVE-2022-24858

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-04-19T23:15:13.317

Modified: 2022-04-29T23:53:31.653

Link: CVE-2022-24858

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "next-auth", "vendor": "nextauthjs", "versions": [{"status": "affected", "version": "< 3.29.2, < 4.3.2"}]}], "descriptions": [{"lang": "en", "value": "next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "description": "CWE-290: Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-19T22:25:10", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw"}, {"tags": ["x_refsource_MISC"], "url": "https://next-auth.js.org/configuration/callbacks#redirect-callback"}, {"tags": ["x_refsource_MISC"], "url": "https://next-auth.js.org/getting-started/upgrade-v4"}], "source": {"advisory": "GHSA-f9wg-5f46-cjmw", "discovery": "UNKNOWN"}, "title": "Default redirect callback vulnerable to open redirects", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24858", "STATE": "PUBLIC", "TITLE": "Default redirect callback vulnerable to open redirects"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "next-auth", "version": {"version_data": [{"version_value": "< 3.29.2, < 4.3.2"}]}}]}, "vendor_name": "nextauthjs"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-290: Authentication Bypass by Spoofing"}]}]}, "references": {"reference_data": [{"name": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw", "refsource": "CONFIRM", "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw"}, {"name": "https://next-auth.js.org/configuration/callbacks#redirect-callback", "refsource": "MISC", "url": "https://next-auth.js.org/configuration/callbacks#redirect-callback"}, {"name": "https://next-auth.js.org/getting-started/upgrade-v4", "refsource": "MISC", "url": "https://next-auth.js.org/getting-started/upgrade-v4"}]}, "source": {"advisory": "GHSA-f9wg-5f46-cjmw", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:20:50.660Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://next-auth.js.org/configuration/callbacks#redirect-callback"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://next-auth.js.org/getting-started/upgrade-v4"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24858", "datePublished": "2022-04-19T22:25:10", "dateReserved": "2022-02-10T00:00:00", "dateUpdated": "2024-08-03T04:20:50.660Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextauth.js:next-auth:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "0E5C04FB-E569-40FF-8C92-15537801B135", "versionEndExcluding": "3.29.2", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextauth.js:next-auth:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "C0B0CDDB-30B2-48C4-A992-45D8477DB821", "versionEndExcluding": "4.3.2", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`."}, {"lang": "es", "value": "Los usuarios de next-auth versiones v3 anteriores a 3.29.2 est\u00e1n afectados. Los usuarios de next-auth versiones4 anteriores a la versi\u00f3n 4.3.2 tambi\u00e9n est\u00e1n afectados. La actualizaci\u00f3n a la versi\u00f3n 3.29.2 o 4.3.2 corregir\u00e1 esta vulnerabilidad. Si no puede actualizar por alguna raz\u00f3n, puede a\u00f1adir una configuraci\u00f3n a su opci\u00f3n de callbacks. Si ya presenta una llamada de retorno \"redirect\", aseg\u00farese de que el origen \"url\" entrante coincida con el \"baseUrl\""}], "id": "CVE-2022-24858", "lastModified": "2022-04-29T23:53:31.653", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-04-19T23:15:13.317", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://next-auth.js.org/configuration/callbacks#redirect-callback"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://next-auth.js.org/getting-started/upgrade-v4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-290"}], "source": "security-advisories@github.com", "type": "Secondary"}]}