Miggo Logo

CVE-2022-31093: Improper Handling of `callbackUrl` parameter in next-auth

7.5

CVSS Score
3.1

Basic Information

EPSS Score
0.74138%
Published
6/21/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
next-authnpm< 3.29.53.29.5
next-authnpm>= 4.0.0, < 4.5.04.5.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability occurred because the system converted user-provided 'callbackUrl' values into URL objects without proper validation. The commit diff shows that the fix involved adding 'isValidHttpUrl' checks in assertConfig for both query parameters and cookies. Since assertConfig is the configuration validation entry point, its lack of callbackUrl validation in pre-patch versions directly caused the unhandled errors. The function's role in pre-processing configuration parameters makes it the clear vulnerable point.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *n *tt**k*r **n s*n* * r*qu*st to *n *pp usin* N*xt*ut*.js wit* *n inv*li* `**ll***kUrl` qu*ry p*r*m*t*r, w*i** int*rn*lly w* *onv*rt to * `URL` o*j**t. T** URL inst*nti*tion woul* **il *u* to * m*l*orm** URL **in* p*ss** into t** *onstru

Reasoning

T** vuln*r**ility o**urr** ****us* t** syst*m *onv*rt** us*r-provi*** '**ll***kUrl' v*lu*s into URL o*j**ts wit*out prop*r v*li**tion. T** *ommit *i** s*ows t**t t** *ix involv** ***in* 'isV*li**ttpUrl' ****ks in `*ss*rt*on*i*` *or *ot* qu*ry p*r*m*t