Log in Start free

Vulnerability · Published Nov 30, 2023 · Assigned by GitHub_M

CVE-2023-49097ZITADEL vulnerable account takeover via malicious host header injection

High 8.1

In plain English

A high-severity security flaw in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.8%top 44.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account. Accounts with MFA or Passwordless enabled can not be taken over by this attack. This issue has been patched in versions 2.41.6, 2.40.10 and 2.39.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/zitadel/zitadel2.39.9GHSA-2wmj-46rj-qm2w
Gogithub.com/zitadel/zitadel2.40.10GHSA-2wmj-46rj-qm2w
Gogithub.com/zitadel/zitadel2.41.6GHSA-2wmj-46rj-qm2w

Affected products (as reported)

VendorProductVersions
zitadel zitadel >= 2.39.0, < 2.39.9>= 2.40.0, < 2.40.10>= 2.41.0, < 2.41.6

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References