Log in Start free

Vulnerability · Published Mar 27, 2024 · Assigned by GitHub_M

CVE-2024-29892ZITADEL's actions can overload reserved claims

Medium 6.1

In plain English

A medium-severity incorrect authorization in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.8%top 44.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/zitadel/zitadel2.42.17GHSA-gp8g-f42f-95q2
Gogithub.com/zitadel/zitadel2.43.11GHSA-gp8g-f42f-95q2
Gogithub.com/zitadel/zitadel2.44.7GHSA-gp8g-f42f-95q2
Gogithub.com/zitadel/zitadel2.45.5GHSA-gp8g-f42f-95q2
Gogithub.com/zitadel/zitadel2.46.5GHSA-gp8g-f42f-95q2
Gogithub.com/zitadel/zitadel2.47.8GHSA-gp8g-f42f-95q2
Gogithub.com/zitadel/zitadel2.48.3GHSA-gp8g-f42f-95q2
Gogithub.com/zitadel/zitadelno fix listedGO-2024-2664

Affected products (as reported)

VendorProductVersions
zitadel zitadel < 2.42.17>= 2.43.0, < 2.43.11>= 2.44.0, < 2.44.7>= 2.45.0, < 2.45.5>= 2.46.0, < 2.46.5>= 2.47.0, < 2.47.8>= 2.48.0, < 2.48.3

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References