User-Uploaded Avatar Image Vulnerability in ZITADEL by ZITADEL

CVE-2024-29891

Summary

A flaw in the ZITADEL platform allows for the upload of avatar images without adequate validation. An attacker can exploit this to upload malicious HTML disguised as an image, potentially leading to unauthorized access to a user's account. This exploit necessitates that the victim must open the malicious image while logged into ZITADEL, which currently affects users of the Firefox browser. Chrome, Safari, and Edge are not vulnerable to this attack. The issue has been addressed in various updates, including versions 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.

References