CVE-2022-31127
📋 TL;DR
NextAuth.js email authentication vulnerability allows attackers to inject malicious HTML into sign-in emails, enabling phishing attacks. This affects NextAuth.js v3 before 3.29.8 and v4 before 4.9.0. Attackers can trick users into clicking malicious links by exploiting the email parameter in verification emails.
💻 Affected Systems
- NextAuth.js
📦 What is this software?
Next Auth by Nextauth.js
Next Auth by Nextauth.js
⚠️ Risk & Real-World Impact
Worst Case
Successful phishing campaign leading to credential theft, account compromise, or malware installation on user systems.
Likely Case
Phishing emails sent to users with malicious links, potentially compromising individual accounts.
If Mitigated
No impact if email parameter is properly sanitized or excluded from HTML rendering.
🎯 Exploit Status
Exploit requires sending malicious email parameter to signin endpoint, which is straightforward and documented in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.29.8+ or v4.9.0+
Vendor Advisory: https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pgjx-7f9g-9463
Restart Required: Yes
Instructions:
1. Update NextAuth.js: npm update next-auth or yarn upgrade next-auth. 2. For v3 users, upgrade to v3.29.8+. 3. For v4 users, upgrade to v4.9.0+. 4. Restart your Next.js application.
🔧 Temporary Workarounds
Sanitize email parameter in custom sendVerificationRequest
allManually sanitize or exclude the email parameter from HTML rendering in custom email implementations.
// In your sendVerificationRequest function, sanitize email parameter or remove from HTML body
🧯 If You Can't Patch
- Implement input validation to reject email addresses containing HTML tags
- Disable email provider authentication until patching is possible
🔍 How to Verify
Check if Vulnerable:
Check package.json for NextAuth.js version: if v3 < 3.29.8 or v4 < 4.9.0, you are vulnerable.Check Version:
npm list next-auth or yarn list next-authVerify Fix Applied:
Verify NextAuth.js version is v3.29.8+ or v4.9.0+ in package.json and test email sign-in with HTML-containing email parameter.📡 Detection & Monitoring
Log Indicators:
- Unusual email parameter values containing HTML tags in authentication logs
- Multiple failed sign-in attempts with unusual email formats
Network Indicators:
- POST requests to /api/auth/signin/email with email parameter containing HTML tags
SIEM Query:
source="nextauth" AND (email="*<*" OR email="*>*")🔗 References
- https://github.com/nextauthjs/next-auth/commit/ae834f1e08a4a9915665eecb9479c74c6b039c9c
- https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.9.0
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pgjx-7f9g-9463
- https://next-auth.js.org/getting-started/upgrade-v4
- https://next-auth.js.org/providers/email#customizing-emails
- https://github.com/nextauthjs/next-auth/commit/ae834f1e08a4a9915665eecb9479c74c6b039c9c
- https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.9.0
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pgjx-7f9g-9463
- https://next-auth.js.org/getting-started/upgrade-v4
- https://next-auth.js.org/providers/email#customizing-emails
