Vulnerability · Published Jul 29, 2020 · Assigned by GitHub_M

CVE-2020-15125Authorization header is not sanitized in an error object in auth0

High 7.7

In plain English

A high-severity security flaw in node-auth0 from auth0. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)1.5%top 25.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	auth0	2.27.1	GHSA-5jpf-pj32-xx53

Affected products (as reported)

Vendor	Product	Versions
auth0	node-auth0	< 2.27.1

Weakness: CWE-209 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/auth0/node-auth0/security/advisories/GHSA-5jpf-pj32-xx53 x_refsource_CONFIRM
https://github.com/auth0/node-auth0/pull/507 x_refsource_MISC
https://github.com/auth0/node-auth0/pull/507/commits/62ca61b3348ec8e74d7d00358661af1a8bc98a3c x_refsource_MISC
https://github.com/auth0/node-auth0/tree/v2.27.1 x_refsource_MISC