Weak Password Recovery Mechanism for Forgotten Password Affecting github.com/zitadel/zitadel/internal/api/http/middleware package, versions >=2.39.0 <2.39.9 >=2.40.0 <2.40.10 >=2.41.0 <2.41.6
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMZITADELZITADELINTERNALAPIHTTPMIDDLEWARE-6096053
- published 30 Nov 2023
- disclosed 30 Nov 2023
- credit Amit Laish – GE Vernova
Introduced: 30 Nov 2023
CVE-2023-49097 Open this link in a new tabHow to fix?
Upgrade github.com/zitadel/zitadel/internal/api/http/middleware to version 2.39.9, 2.40.10, 2.41.6 or higher.
Overview
Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password. When the notification triggers requests, the Forwarded or X-Forwarded-Host header is used to build the email button link to confirm a password reset with the emailed code. An attacker can retrieve the secret code and use it to reset the user's password and take over their account by overwriting this header and tricking a user into clicking the link to a malicious site in the email. This is only exploitable if the user does not have MFA or Passwordless enabled.
Workaround
A ZITADEL fronting proxy can be configured to delete all Forwarded and X-Forwarded-Host header values before sending requests to ZITADEL self-hosted environments.