CVE-2024-28855
published 2024-03-18CVE-2024-28855: ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.78%
51.3th percentile
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen. While it was possible to inject HTML including JavaScript, the execution of such scripts would be prevented by the Content Security Policy. Versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15 contain a patch for this issue. No known workarounds are available.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | zitadel_zitadel | >= 0 < 0.0.0-20240311065202-07ec2efa9dc6 | 0.0.0-20240311065202-07ec2efa9dc6 |
| github.com | zitadel_zitadel | >= 0 < 1.80.0-v2.20.0.20240312162750-5908b97e7c22 | 1.80.0-v2.20.0.20240312162750-5908b97e7c22 |
| github.com | zitadel_zitadel | >= 0.0.0 < 1.80.0-v2.20.0.20240311065202-07ec2efa9dc6 | 1.80.0-v2.20.0.20240311065202-07ec2efa9dc6 |
| github.com | zitadel_zitadel | >= 1.80.1 < 2.41.15 | 2.41.15 |
| github.com | zitadel_zitadel | >= 2.42.0 < 2.42.15 | 2.42.15 |
| github.com | zitadel_zitadel | >= 2.43.0 < 2.43.9 | 2.43.9 |
| github.com | zitadel_zitadel | >= 2.44.0 < 2.44.3 | 2.44.3 |
| github.com | zitadel_zitadel | >= 2.45.0 < 2.45.1 | 2.45.1 |
| github.com | zitadel_zitadel | >= 2.46.0 < 2.46.1 | 2.46.1 |
| github.com | zitadel_zitadel | >= 2.47.0 < 2.47.4 | 2.47.4 |
| zitadel | zitadel | < 2.41.15 | 2.41.15 |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | >= 2.42.0 < 2.42.15 | 2.42.15 |
| zitadel | zitadel | >= 2.43.0 < 2.43.9 | 2.43.9 |
| zitadel | zitadel | >= 2.44.0 < 2.44.3 | 2.44.3 |
| zitadel | zitadel | >= 2.47.0 < 2.47.4 | 2.47.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
XSS in github.com/zitadel/zitadel
osv·2024-03-27
CVE-2024-28855 XSS in github.com/zitadel/zitadel
XSS in github.com/zitadel/zitadel
The Login UI did not sanitize input parameters. An attacker could create a malicious link, where injected code would be rendered as part of the login screen.
GHSA
Improper HTML sanitization in ZITADEL
ghsa·2024-03-18
CVE-2024-28855 [HIGH] CWE-20 Improper HTML sanitization in ZITADEL
Improper HTML sanitization in ZITADEL
### Impact
ZITADEL uses Go templates to render the login UI.
Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen.
While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by the Content Security Policy.
### Patches
2.x versions are fixed on >= [2.47.3](https://github.com/zitadel/zitadel/releases/tag/v2.47.3)
2.46.x versions are fixed on >= [2.46.1](https://github.com/zitadel/zitadel/releases/tag/v2.46.1)
2.45.x versions are fixed on >= [2.45.1](https://github.com/zitadel/zitadel/releases/tag/v2.45.1)
2
OSV
Improper HTML sanitization in ZITADEL
osv·2024-03-18
CVE-2024-28855 [HIGH] Improper HTML sanitization in ZITADEL
Improper HTML sanitization in ZITADEL
### Impact
ZITADEL uses Go templates to render the login UI.
Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen.
While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by the Content Security Policy.
### Patches
2.x versions are fixed on >= [2.47.3](https://github.com/zitadel/zitadel/releases/tag/v2.47.3)
2.46.x versions are fixed on >= [2.46.1](https://github.com/zitadel/zitadel/releases/tag/v2.46.1)
2.45.x versions are fixed on >= [2.45.1](https://github.com/zitadel/zitadel/releases/tag/v2.45.1)
2
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/zitadel/zitadel/releases/tag/v2.41.15https://github.com/zitadel/zitadel/releases/tag/v2.42.15https://github.com/zitadel/zitadel/releases/tag/v2.43.9https://github.com/zitadel/zitadel/releases/tag/v2.44.3https://github.com/zitadel/zitadel/releases/tag/v2.45.1https://github.com/zitadel/zitadel/releases/tag/v2.46.1https://github.com/zitadel/zitadel/releases/tag/v2.47.3https://github.com/zitadel/zitadel/security/advisories/GHSA-hfrg-4jwr-jfpjhttps://github.com/zitadel/zitadel/releases/tag/v2.41.15https://github.com/zitadel/zitadel/releases/tag/v2.42.15https://github.com/zitadel/zitadel/releases/tag/v2.43.9https://github.com/zitadel/zitadel/releases/tag/v2.44.3https://github.com/zitadel/zitadel/releases/tag/v2.45.1https://github.com/zitadel/zitadel/releases/tag/v2.46.1https://github.com/zitadel/zitadel/releases/tag/v2.47.3https://github.com/zitadel/zitadel/security/advisories/GHSA-hfrg-4jwr-jfpj
2024-03-18
Published