CVE-2023-49097
Description
ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account. Accounts with MFA or Passwordless enabled can not be taken over by this attack. This issue has been patched in versions 2.41.6, 2.40.10 and 2.39.9.
How to fix
- zitadel zitadel2.39.9, 2.40.10, 2.41.6 or later
- github.com/zitadel/zitadel2.39.9, 2.40.10, 2.41.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zitadel zitadel | 2.39.0 ≤ v < 2.39.9, 2.40.0 ≤ v < 2.40.10, 2.41.0 ≤ v < 2.41.6 | 2.39.9, 2.40.10, 2.41.6 |
| github.com/zitadel/zitadelGo | 2.39.0 ≤ v < 2.39.9, 2.40.0 ≤ v < 2.40.10, 2.41.0 ≤ v < 2.41.6 | 2.39.9, 2.40.10, 2.41.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.