PT-2023-18543 · Zitadel · Zitadel

Livio-Aco · Published 2023-01-11 · Updated 2023-01-24 · CVE-2023-22492

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 2.16.4 ZITADEL versions prior to 2.17.3

Description ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration).

Recommendations For versions prior to 2.16.4, update to version 2.16.4 or later. For versions prior to 2.17.3, update to version 2.17.3 or later. As a temporary workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2023-22492

GHSA-6RRR-78XP-5JP8

Affected Products

Zitadel

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22492.json · Exploit
• https://github.com/zitadel/zitadel/security/advisories/GHSA-6rrr-78xp-5jp8 · Patch
• https://github.com/zitadel/zitadel/commit/fc892c52a10cd4ffdac395747494f3a93a7494c2 · Patch
• https://github.com/zitadel/zitadel/commit/301e22c4956ead6014a8179463c37263f7301a83 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-22492 · Security Note
• https://osv.dev/vulnerability/GHSA-6rrr-78xp-5jp8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22492 · Vendor Advisory
• https://github.com/zitadel/zitadel · Note
• https://github.com/zitadel/zitadel/releases/tag/v2.17.3 · Note
• https://github.com/zitadel/zitadel/releases/tag/v2.16.4 · Note
• https://t.me/cvenotify/41836 · Telegram Post