CVE-2024-47000: Service Users Deactivation not Working in Zitadel
Impact ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to applications and resources.
Patches
2.x versions are fixed on >= 2.62.1 2.61.x versions are fixed on >= 2.61.1 2.60.x versions are fixed on >= 2.60.2 2.59.x versions are fixed on >= 2.59.3 2.58.x versions are fixed on >= 2.58.5 2.57.x versions are fixed on >= 2.57.5 2.56.x versions are fixed on >= 2.56.6 2.55.x versions are fixed on >= 2.55.8 2.54.x versions are fixed on >= 2.54.10
Workarounds Instead of deactivating the service account, consider creating new credentials and replacing the old ones wherever they are used. This effectively prevents the deactivated service account from being utilized.
- Revoke all existing authentication keys associated with the service account - Rotate the service account's password
Questions If you have any questions or comments about this advisory, please email us at
security@zitadel.com
Other sources
Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to applications and resources. Versions 2.62.1, 2.61.1, 2.60.2, 2.59.3, 2.58.5, 2.57.5, 2.56.6, 2.55.8, and 2.54.10 have been released which address this issue. Users are advised t upgrade. Users unable to upgrade may instead of deactivating the service account, consider creating new credentials and replacing the old ones wherever they are used. This effectively prevents the deactivated service account from being utilized. Be sure to revoke all existing authentication keys associated with the service account and to rotate the service account's password.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47000?
CVE-2024-47000 is considered a high severity vulnerability due to its potential for unauthorized access to applications and resources.
How do I fix CVE-2024-47000?
To fix CVE-2024-47000, upgrade to ZITADEL version 2.54.10 or later, or to any fixed versions from 2.55.0 up to 2.62.0.
What applications are affected by CVE-2024-47000?
CVE-2024-47000 affects all versions of ZITADEL prior to the fixed versions noted above.
What issues does CVE-2024-47000 introduce?
CVE-2024-47000 allows deactivated service accounts to still request tokens, leading to potential unauthorized access.
Is there a workaround for CVE-2024-47000?
There is no documented workaround for CVE-2024-47000; applying the available patches is necessary.