CVE-2023-49097

ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account. Accounts with MFA or Passwordless enabled can not be taken over by this attack. This issue has been patched in versions 2.41.6, 2.40.10 and 2.39.9.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/zitadel/zitadel/security/advisories/GHSA-2wmj-46rj-qm2w	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zitadel:zitadel::::::::
	cpe:2.3:a:zitadel:zitadel::::::::
	cpe:2.3:a:zitadel:zitadel::::::::

History

No history.

Information

Published : 2023-11-30 05:15

Updated : 2023-12-08 15:18

NVD link : CVE-2023-49097

Mitre link : CVE-2023-49097

CVE.ORG link : CVE-2023-49097

JSON object : View

Products Affected

zitadel

zitadel

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2023-49097", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2023-11-30T05:15:09.503", "references": [{"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-2wmj-46rj-qm2w", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account. Accounts with MFA or Passwordless enabled can not be taken over by this attack. This issue has been patched in versions 2.41.6, 2.40.10 and 2.39.9.\n"}, {"lang": "es", "value": "ZITADEL es un sistema de infraestructura de identidad. ZITADEL utiliza el encabezado de solicitudes de activaci\u00f3n de notificaciones Forwarded o X-Forwarded-Host para crear el enlace del bot\u00f3n enviado en los correos electr\u00f3nicos para confirmar un restablecimiento de contrase\u00f1a con el c\u00f3digo enviado por correo electr\u00f3nico. Si este encabezado se sobrescribe y un usuario hace clic en el enlace a un sitio malicioso en el correo electr\u00f3nico, el c\u00f3digo secreto se puede recuperar y utilizar para restablecer la contrase\u00f1a del usuario y hacerse cargo de su cuenta. Este ataque no puede apoderarse de las cuentas con MFA o sin contrase\u00f1a habilitadas. Este problema se solucion\u00f3 en las versiones 2.41.6, 2.40.10 y 2.39.9."}], "lastModified": "2023-12-08T15:18:19.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B217DCB5-07BA-4BA3-97A2-91397DAA878D", "versionEndExcluding": "2.39.9", "versionStartIncluding": "2.39.0"}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75A6467A-C432-4810-A2D9-FBED9090ED67", "versionEndExcluding": "2.40.10", "versionStartIncluding": "2.40.0"}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A14C74C2-0A2A-4F71-86D6-7CFE7911D6EB", "versionEndExcluding": "2.41.6", "versionStartIncluding": "2.41.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}