ZITADEL vulnerable account takeover via malicious host header injection
CVE-2023-49097

8.1HIGH

Key Information:

Vendor

Zitadel

Status
Zitadel
Vendor
CVE Published:
30 November 2023

What is CVE-2023-49097?

ZITADEL's identity infrastructure is susceptible to an improper input validation issue due to the mismanagement of the 'Forwarded' or 'X-Forwarded-Host' headers. This security flaw allows an attacker to craft a malicious link for password reset emails. When an unsuspecting user clicks the manipulated link, their secret code is exposed, facilitating unauthorized access to their account. Notably, accounts secured with Multi-Factor Authentication (MFA) or Passwordless authentication methods remain protected against this vulnerability. It is essential for users of ZITADEL to update to versions 2.41.6, 2.40.10, or 2.39.9 to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

zitadel >= 2.39.0, < 2.39.9 < 2.39.0, 2.39.9

zitadel >= 2.40.0, < 2.40.10 < 2.40.0, 2.40.10

zitadel >= 2.41.0, < 2.41.6 < 2.41.0, 2.41.6

References

https://github.com/zitadel/zitadel/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.