CVE-2024-49753
published 2024-10-25CVE-2024-49753: Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL…
PriorityP355critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.64%
46.2th percentile
Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures. This vulnerability potentially allows unauthorized access to unsecured internal endpoints, which may contain sensitive information or functionalities. Versions 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | zitadel_zitadel | >= 0 < 0.0.0-20241022141644-79fb4cc1cc6e | 0.0.0-20241022141644-79fb4cc1cc6e |
| github.com | zitadel_zitadel | >= 0.0.0 < 1.80.0-v2.20.0.20241022141644-79fb4cc1cc6e | 1.80.0-v2.20.0.20241022141644-79fb4cc1cc6e |
| github.com | zitadel_zitadel | >= 1.80.1 < 2.58.7 | 2.58.7 |
| github.com | zitadel_zitadel | >= 2.59.0 < 2.59.5 | 2.59.5 |
| github.com | zitadel_zitadel | >= 2.60.0 < 2.60.4 | 2.60.4 |
| github.com | zitadel_zitadel | >= 2.61.0 < 2.61.4 | 2.61.4 |
| github.com | zitadel_zitadel | >= 2.62.0 < 2.62.8 | 2.62.8 |
| github.com | zitadel_zitadel | >= 2.63.0 < 2.63.6 | 2.63.6 |
| github.com | zitadel_zitadel | >= 2.64.0 < 2.64.1 | 2.64.1 |
| zitadel | zitadel | < 2.58.7 | 2.58.7 |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | — | — |
| zitadel | zitadel | >= 2.59.0 < 2.59.5 | 2.59.5 |
| zitadel | zitadel | >= 2.60.0 < 2.60.4 | 2.60.4 |
| zitadel | zitadel | >= 2.61.0 < 2.61.4 | 2.61.4 |
| zitadel | zitadel | >= 2.62.0 < 2.62.8 | 2.62.8 |
| zitadel | zitadel | >= 2.63.0 < 2.63.6 | 2.63.6 |
| zitadel | zitadel | >= 2.64.0 < 2.64.1 | 2.64.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel
osv·2024-10-28
CVE-2024-49753 Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel
Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel
Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/zitadel/zitadel before v2.58.7, from v2.59.0 before v2.59.5, from v2.60.0 before v2.60.4, from v2.61.0 before v2.61.4, from v2.62.0 before v2.62.8, from v2.63.0 before v2.63.6, from v2.64.0 before v2.64.1.
OSV
Denied Host Validation Bypass in Zitadel Actions
osv·2024-10-25
CVE-2024-49753 [MEDIUM] Denied Host Validation Bypass in Zitadel Actions
Denied Host Validation Bypass in Zitadel Actions
### Summary
A flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures.
### Details
While attempting to send a request directly to 127.0.0.1 via an action results in an error (see image below), the restriction can be bypassed using a custom DNS record.
The relevant action code demonstrates the attempted request to 127.0.0.1:
```
let http = require('zitadel/http')
let logger = require("zitadel/log")
function make_api_call(ctx, api) {
var u
GHSA
Denied Host Validation Bypass in Zitadel Actions
ghsa·2024-10-25
CVE-2024-49753 [MEDIUM] CWE-20 Denied Host Validation Bypass in Zitadel Actions
Denied Host Validation Bypass in Zitadel Actions
### Summary
A flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures.
### Details
While attempting to send a request directly to 127.0.0.1 via an action results in an error (see image below), the restriction can be bypassed using a custom DNS record.
The relevant action code demonstrates the attempted request to 127.0.0.1:
```
let http = require('zitadel/http')
let logger = require("zitadel/log")
function make_api_call(ctx, api) {
var u
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/zitadel/zitadel/releases/tag/v2.58.7https://github.com/zitadel/zitadel/releases/tag/v2.59.5https://github.com/zitadel/zitadel/releases/tag/v2.60.4https://github.com/zitadel/zitadel/releases/tag/v2.61.4https://github.com/zitadel/zitadel/releases/tag/v2.62.8https://github.com/zitadel/zitadel/releases/tag/v2.63.6https://github.com/zitadel/zitadel/releases/tag/v2.64.1https://github.com/zitadel/zitadel/security/advisories/GHSA-6cf5-w9h3-4rqv
2024-10-25
Published