PT-2024-22331 · Zitadel · Zitadel
Amit-Laish
·
Published
2024-03-11
·
Updated
2025-01-07
·
CVE-2024-28197
CVSS v3.1
7.5
High
| Vector | AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Zitadel versions prior to 2.44.3
Zitadel versions 2.45.0 through 2.45.0 before 2.45.1
Zitadel versions prior to 2.46.0
Description
Zitadel is an open source identity management system that uses a cookie to identify the user agent and its user sessions. Although the cookie was handled according to best practices, it was accessible on subdomains of the ZITADEL instance. An attacker could take advantage of this and provide a malicious link hosted on the subdomain to the user to gain access to the victim’s account in certain scenarios. A possible victim would need to login through the malicious link for this exploit to work. If the possible victim already had the cookie present, the attack would not succeed. The attack would further only be possible if there was an initial vulnerability on the subdomain, such as the attacker being able to control DNS or a XSS vulnerability in an application hosted on a subdomain.
Recommendations
For versions prior to 2.44.3, upgrade to version 2.44.3 or later.
For versions 2.45.0 through 2.45.0 before 2.45.1, upgrade to version 2.45.1 or later.
For versions prior to 2.46.0, upgrade to version 2.46.0 or later.
For self-hosted environments unable to upgrade to a patched version, prevent setting the following cookie name on subdomains of your Zitadel instance (e.g. within your WAF):
Secure-zitadel-useragent.Exploit
Fix
Improper Privilege Management
Session Fixation
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Zitadel