CVE-2024-22206: @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
Impact Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router.
Affected Versions All applications that that use @clerk/nextjs versions in the range of >= 4.7.0,< 4.29.3 in a Next.js backend to authenticate API Routes, App Router, or Route handlers. Specifically, those that call auth() in the App Router or getAuth() in the Pages Router. Only the @clerk/nextjs SDK is impacted. Other SDKs, including other Javascript-based SDKs, are not impacted.
Patches Fix included in @clerk/nextjs@4.29.3.
References - https://clerk.com/changelog/2024-01-12 - https://github.com/clerk/javascript/releases/tag/%40clerk%2Fnextjs%404.29.3
Other sources
Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@clerk/nextjsto a version that resolves this vulnerability.Fixed in 4.29.3 - Upgrade
Upgrade
@clerk/nextjsto a version that resolves this vulnerability.Fixed in 4.29.3 - Compensating control
For Next.js backends using @clerk/nextjs versions in the range >= 4.7.0 and < 4.29.3, ensure API routes, App Router, and route handlers that rely on auth() (App Router) or getAuth() (Pages Router) are not exposed to unauthorized users until upgraded to @clerk/nextjs 4.29.3.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22206?
The severity of CVE-2024-22206 is high due to the potential for unauthorized access or privilege escalation.
How do I fix CVE-2024-22206?
To fix CVE-2024-22206, you should upgrade the @clerk/nextjs package to version 4.29.3 or later.
Which versions are affected by CVE-2024-22206?
CVE-2024-22206 affects all versions of @clerk/nextjs in the range of 4.7.0 to 4.29.2.
What causes CVE-2024-22206?
CVE-2024-22206 is caused by a logic flaw in the auth() function in the App Router or getAuth() function in the Pages Router.
Who is affected by CVE-2024-22206?
Any applications using the affected versions of @clerk/nextjs in a Next.js backend are vulnerable to CVE-2024-22206.