CVE-2022-35924: Next auth NextAuth.js Before 4.10.3 And 3.29.10 Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xv97-c62v-4587",
  "modified" : "2022-08-11T22:13:10Z",
  "published" : "2022-08-02T18:00:33Z",
  "aliases" : [ "CVE-2022-35924" ],
  "summary" : "NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails",
  "details" : "### Impact\n`next-auth` users who are using the `EmailProvider` either in versions before `4.10.3` or `3.29.10` are affected.\n\nIf an attacker could forge a request that sent a comma-separated list of emails (eg.: `attacker@attacker.com,victim@victim.com`) to the sign-in endpoint, NextAuth.js would send emails to both the attacker and the victim's e-mail addresses. The attacker could then login as a newly created user with the email being `attacker@attacker.com,victim@victim.com`. This means that basic authorization like `email.endsWith(\"@victim.com\")` in the `signIn` callback would fail to communicate a threat to the developer and would let the attacker bypass authorization, even with an `@attacker.com` address.\n\n### Patches\nWe patched this vulnerability in `v4.10.3` and `v3.29.10` by normalizing the email value that is sent to the sign-in endpoint before accessing it anywhere else. We also added a `normalizeIdentifier` callback on the `EmailProvider` configuration, where you can further tweak your requirements for what your system considers a valid e-mail address. (E.g.: strict RFC2821 compliance)\n\nTo upgrade, run one of the following:\n```sh\nnpm i next-auth@latest\n```\n```sh\nyarn add next-auth@latest\n```\n```sh\npnpm add next-auth@latest\n```\n\n(This will update to the latest v4 version, but you can change `latest` to `3` if you want to stay on v3. This is not recommended. v3 is unmaintained.)\n\n### Workarounds\nIf for some reason you cannot upgrade, you can normalize the incoming request like the following, using Advanced Initialization:\n```ts\n// pages/api/auth/[...nextauth].ts\n\nfunction normalize(identifier) {\n  // Get the first two elements only,\n  // separated by `@` from user input.\n  let [local, domain] = identifier.toLowerCase().trim().split(\"@\")\n  // The part before \"@\" can contain a \",\"\n  // but we remove it on the domain part\n  domain = domain.split(\",\")[0]\n  return `${local}@${domain}`\n}\n\nexport default async function handler(req, res) {\n  if (req.body.email) req.body.email = normalize(req.body.email)\n  return await NextAuth(req, res, {/* your options */ })\n}\n```\n\n### References\n- EmailProvider: https://next-auth.js.org/providers/email\n- Normalize the email address: https://next-auth.js.org/providers/email#normalizing-the-email-address\n- Email syntax: https://en.wikipedia.org/wiki/Email_address#Local-part\n- `signIn` callback: https://next-auth.js.org/configuration/callbacks#sign-in-callback\n- Advanced Initialization: https://next-auth.js.org/configuration/initialization#advanced-initialization\n- `nodemailer` address: https://nodemailer.com/message/addresses\n\n### For more information\n\nIf you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability\n\n### Timeline\n\nThe issue was reported 26th of July, a response was sent out in less than 1 hour and after identifying the issue a patch was published within 5 working days.\n\n### Acknowledgments\n\nWe would like to thank [Socket](https://socket.dev) for disclosing this vulnerability in a responsible manner and following up until it got published.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "next-auth"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0"
      }, {
        "fixed" : "4.10.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "next-auth"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.29.10"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xv97-c62v-4587"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-35924"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nextauthjs/next-auth/commit/afb1fcdae3cc30445038ef588e491d139b916003"
  }, {
    "type" : "WEB",
    "url" : "https://en.wikipedia.org/wiki/Email_address#Local-part"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nextauthjs/next-auth"
  }, {
    "type" : "WEB",
    "url" : "https://next-auth.js.org/configuration/callbacks#sign-in-callback"
  }, {
    "type" : "WEB",
    "url" : "https://next-auth.js.org/configuration/initialization#advanced-initialization"
  }, {
    "type" : "WEB",
    "url" : "https://next-auth.js.org/providers/email"
  }, {
    "type" : "WEB",
    "url" : "https://next-auth.js.org/providers/email#normalizing-the-e-mail-address"
  }, {
    "type" : "WEB",
    "url" : "https://next-auth.js.org/providers/email#normalizing-the-email-address"
  }, {
    "type" : "WEB",
    "url" : "https://nodemailer.com/message/addresses"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-863" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-08-02T18:00:33Z",
    "nvd_published_at" : "2022-08-02T18:15:00Z"
  }
}