NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

ScnSocialAuth Cross-site Scripting vulnerability in login redirect paramGHSA-g6f5-4w43-2x63

MEDIUMFix: SocalNick/ScnSocialAuth@4a00966

GHSA-g6f5-4w43-2x63 is a medium-severity (CVSS 6.1) vulnerability in socalnick/scn-social-auth. A fix is available for socalnick/scn-social-auth — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Dec 4, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐘socalnick/scn-social-auth

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

ScnSocialAuth version 1.15.2 has been released and includes a security for this vulnerability. Fix has been applied in https://github.com/SocalNick/ScnSocialAuth/commit/4a00966c41bc37251586d007564c5c891eba3700

Affected versions

All versions below 1.15.2 are affected. dev-master is fixed starting from https://github.com/SocalNick/ScnSocialAuth/commit/4a00966c41bc37251586d007564c5c891eba3700

Exploits

Because of missing escaping of the URL param redirect a XSS attack is possible. For example: Setting the redirect param to "><a%20href="http://github.com">GitHub.com</a><inpu%20type="hidden"%20" would result in a link added to the login page.

Resolution

If you are using any version of ScnSocialAuth below 1.15.2 please upgrade immediately by running composer update.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistsocalnick/scn-social-authall versions1.15.2composer require socalnick/scn-social-auth:^1.15.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for socalnick/scn-social-auth, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update socalnick/scn-social-auth to 1.15.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g6f5-4w43-2x63 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

ScnSocialAuth version 1.15.2 has been released and includes a security for this vulnerability. Fix has been applied in https://github.com/SocalNick/ScnSocialAuth/commit/4a00966c41bc37251586d007564c5c891eba3700 ### Affected versions All versions below 1.15.2 are affected. dev-master is fixed starting from https://github.com/SocalNick/ScnSocialAuth/commit/4a00966c41bc37251586d007564c5c891eba3700 ### Exploits Because of missing escaping of the URL param redirect a XSS attack is possible. For example: Setting the redirect param to `"><a%20href="http://github.com">GitHub.com</a><inpu%20type="hidd
O3 Security · Impact-Aware SCA

Is GHSA-g6f5-4w43-2x63 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
ScnSocialAuth Cross-site Scripting vulnerability in login…