Zitadel Fixes Cookie Vulnerability Affecting User Sessions

CVE-2024-28197

Summary

Zitadel, an open-source identity management system, has a vulnerability involving its user session management through cookies. The vulnerability arises due to improper accessibility of cookies on subdomains of the Zitadel instance, which could allow attackers to exploit the situation by hosting malicious links. Affected users must navigate to the harmful link for the vulnerability to be leveraged, and the attack is contingent upon the availability of the user's cookie and a pre-existing weakness on a subdomain, such as a DNS compromise or a cross-site scripting issue. Zitadel has issued patches for versions 2.46.0, 2.45.1, and 2.44.3, and users are urged to update to the latest versions to mitigate the risk. It's important to note that applying the patch will result in session invalidation for users, necessitating a new user session initiation.

References