CVE-2024-29892: ZITADEL's actions can overload reserved claims
Impact Under certain circumstances an action could set reserved claims managed by ZITADEL.
For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name
json {"urn:zitadel:iam:user:resourceowner:name": "ACME"}
if it was not set by ZITADEL itself.
To compensate for this we introduced a protection that does prevent actions from changing claims that start with urn:zitadel:iam
Patches 2.x versions are fixed on >= 2.48.3 2.47.x versions are fixed on >= 2.47.8 2.46.x versions are fixed on >= 2.46.5 2.45.x versions are fixed on >= 2.45.5 2.44.x versions are fixed on >= 2.44.7 2.43.x versions are fixed on >= 2.43.11 2.42.x versions are fixed on >= 2.42.17
Workarounds No workaround available since a patch is available
Credits Many thanks to @schettn whose disclosure of another topic lead us to find this issue.
Other sources
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name. To compensate for this we introduced a protection that does prevent actions from changing claims that start with urn:zitadel:iam. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.48.3 - Upgrade
Upgrade
go/github.com/zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.47.8 - Upgrade
Upgrade
go/github.com/zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.46.5 - Upgrade
Upgrade
go/github.com/zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.45.5 - Upgrade
Upgrade
go/github.com/zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.44.7 - Upgrade
Upgrade
go/github.com/zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.43.11 - Upgrade
Upgrade
go/github.com/zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.42.17 - Upgrade
Upgrade
zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.42.17 - Upgrade
Upgrade
zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.43.11 - Upgrade
Upgrade
zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.44.7 - Upgrade
Upgrade
zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.45.5 - Upgrade
Upgrade
zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.46.5 - Upgrade
Upgrade
zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.47.8 - Upgrade
Upgrade
zitadel/zitadelto a version that resolves this vulnerability.Fixed in 2.48.3
Event History
Frequently Asked Questions
What impact does CVE-2024-29892 have on ZITADEL?
CVE-2024-29892 allows an action to inadvertently set reserved claims managed by ZITADEL under specific circumstances.
What versions of ZITADEL are affected by CVE-2024-29892?
CVE-2024-29892 affects ZITADEL versions from 2.42.17 up to 2.48.3 inclusive.
How can I fix CVE-2024-29892?
To resolve CVE-2024-29892, upgrade ZITADEL to version 2.48.4 or later.
Is there a workaround for CVE-2024-29892?
No official workaround is provided for CVE-2024-29892; updating to a non-vulnerable version is recommended.
What should I do if I cannot update ZITADEL due to CVE-2024-29892?
If you cannot update, it is crucial to minimize exposure and monitor systems closely for any anomalies.