CVE-2023-49097
published 2023-11-30CVE-2023-49097: ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link…
PriorityP347high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.77%
50.9th percentile
ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account. Accounts with MFA or Passwordless enabled can not be taken over by this attack. This issue has been patched in versions 2.41.6, 2.40.10 and 2.39.9.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | zitadel_zitadel | >= 2.39.0 < 2.39.9 | 2.39.9 |
| github.com | zitadel_zitadel | >= 2.40.0 < 2.40.10 | 2.40.10 |
| github.com | zitadel_zitadel | >= 2.41.0 < 2.41.6 | 2.41.6 |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | >= 2.39.0 < 2.39.9 | 2.39.9 |
| zitadel | zitadel | >= 2.40.0 < 2.40.10 | 2.40.10 |
| zitadel | zitadel | >= 2.41.0 < 2.41.6 | 2.41.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
ZITADEL Account Takeover via Malicious Host Header Injection
ghsa·2023-11-29
CVE-2023-49097 [HIGH] CWE-640 ZITADEL Account Takeover via Malicious Host Header Injection
ZITADEL Account Takeover via Malicious Host Header Injection
### Impact
ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account.
Accounts with MFA or Passwordless enabled can not be taken over by this attack.
### Patches
The patched ZITADEL versions verify, that the auth requests instance is retrieved by the requests original domain (from the Forwarded or X-Forwarded-Host headers if available). If the instance can't be found using the original host or the auth request can't be
OSV
ZITADEL Account Takeover via Malicious Host Header Injection
osv·2023-11-29
CVE-2023-49097 [HIGH] ZITADEL Account Takeover via Malicious Host Header Injection
ZITADEL Account Takeover via Malicious Host Header Injection
### Impact
ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account.
Accounts with MFA or Passwordless enabled can not be taken over by this attack.
### Patches
The patched ZITADEL versions verify, that the auth requests instance is retrieved by the requests original domain (from the Forwarded or X-Forwarded-Host headers if available). If the instance can't be found using the original host or the auth request can't be
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-11-30
Published