Log in Start free

Vulnerability · Published Oct 25, 2024 · Assigned by GitHub_M

CVE-2024-49753Denied Host Validation Bypass in Zitadel Actions

Medium 5.9

In plain English

A medium-severity improper input validation in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.7%top 48.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures. This vulnerability potentially allows unauthorized access to unsecured internal endpoints, which may contain sensitive information or functionalities. Versions 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/zitadel/zitadel2.64.1GHSA-6cf5-w9h3-4rqv
Gogithub.com/zitadel/zitadel2.63.6GHSA-6cf5-w9h3-4rqv
Gogithub.com/zitadel/zitadel2.62.8GHSA-6cf5-w9h3-4rqv
Gogithub.com/zitadel/zitadel2.61.4GHSA-6cf5-w9h3-4rqv
Gogithub.com/zitadel/zitadel2.60.4GHSA-6cf5-w9h3-4rqv
Gogithub.com/zitadel/zitadel2.59.5GHSA-6cf5-w9h3-4rqv
Gogithub.com/zitadel/zitadel2.58.7GHSA-6cf5-w9h3-4rqv
Gogithub.com/zitadel/zitadel0.0.0-20241022141644-79fb4cc1cc6eGHSA-6cf5-w9h3-4rqv
Gogithub.com/zitadel/zitadel1.80.0-v2.20.0.20241022141644-79fb4cc1cc6eGHSA-6cf5-w9h3-4rqv
Gogithub.com/zitadel/zitadelno fix listedGO-2024-3216

Affected products (as reported)

VendorProductVersions
zitadel zitadel >= 2.64, < 2.64.1>= 2.63, < 2.63.6>= 2.62, < 2.62.8>= 2.61, < 2.61.4>= 2.60, < 2.60.4>= 2.59, < 2.59.5< 2.58.7

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

References