Impact
In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user.
Patches
2.x versions are fixed on >= 2.50.3 2.49.x versions are fixed on >= 2.49.5 2.48.x versions are fixed on >= 2.48.5 2.47.x versions are fixed on >= 2.47.10 2.46.x versions are fixed on >= 2.46.7 2.45.x versions are fixed on >= 2.45.7
Workarounds
There is no workaround since a patch is already available.
Questions
If you have any questions or comments about this advisory, please email us at security@zitadel.com
Impact Under certain circumstances an action could set reserved claims managed by ZITADEL.
For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name
json {"urn:zitadel:iam:user:resourceowner:name": "ACME"}
if it was not set by ZITADEL itself.
To compensate for this we introduced a protection that does prevent actions from changing claims that start with urn:zitadel:iam
Patches 2.x versions are fixed on >= 2.48.3 2.47.x versions are fixed on >= 2.47.8 2.46.x versions are fixed on >= 2.46.5 2.45.x versions are fixed on >= 2.45.5 2.44.x versions are fixed on >= 2.44.7 2.43.x versions are fixed on >= 2.43.11 2.42.x versions are fixed on >= 2.42.17
Workarounds No workaround available since a patch is available
Credits Many thanks to @schettn whose disclosure of another topic lead us to find this issue.
Impact
ZITADEL users can upload their own avatar image and various image types are allowed.
Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed image in the browser, where a session in ZITADEL needs to be active for this exploit to work.
The exploit could only be reproduced if the victim was using Firefox. Chrome, Safari as well as Edge did not execute the code.
Patches
2.x versions are fixed on >= 2.48.3 2.47.x versions are fixed on >= 2.47.8 2.46.x versions are fixed on >= 2.46.5 2.45.x versions are fixed on >= 2.45.5 2.44.x versions are fixed on >= 2.44.7 2.43.x versions are fixed on >= 2.43.11 2.42.x versions are fixed on >= 2.42.17
ZITADEL recommends upgrading to the latest versions available in due course.
Workarounds
There is no workaround since a patch is already available.
References
None
Questions
If you have any questions or comments about this advisory, please email us at security@zitadel.com
Credits
Thanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.
Impact
ZITADEL uses Go templates to render the login UI.
Due to a improper use of the text/template instead of the html/template package, the Login UI did not sanitize input parameters. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen. While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by the Content Security Policy.
Patches
2.x versions are fixed on >= 2.47.3 2.46.x versions are fixed on >= 2.46.1 2.45.x versions are fixed on >= 2.45.1 2.44.x versions are fixed on >= 2.44.3 2.43.x versions are fixed on >= 2.43.9 2.42.x versions are fixed on >= 2.42.15 2.41.x versions are fixed on >= 2.41.15
ZITADEL recommends upgrading to the latest versions available in due course.
Workarounds
There is no workaround since a patch is already available.
Questions
If you have any questions or comments about this advisory, please email us at security@zitadel.com
Credits
Thanks to Daniel Philipp - owt and Thomas Wickham - synopsis for reporting this.