Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain allowlist filter via a crafted domain.

For example, if the setting is initialized with:

jwtInterceptorProvider.whiteListedDomains = ['whitelisted.Example.com'];

An attacker can set up a domain whitelistedXexample.com that will pass the allow list filter, as it considers the . separator to be a regex whildcard which matches any character.

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-11537
• https://auth0.com/docs/security/bulletins/cve-2018-11537
• auth0/angular-jwt#174
• auth0/angular-jwt@a4f03b4
• auth0/angular-jwt@e368cf1