CVE-2024-28197
Zitadel
CVE-2024-28197 is a security vulnerability affecting Zitadel, an open-source identity management system. This vulnerability allows an attacker to potentially gain unauthorized access to a victim's account by exploiting a weakness in how Zitadel handles user agent cookies across subdomains. With a CVSS score of 7.5, it signifies a high-severity issue requiring attention; however, the SOCRadar Vulnerability Risk Score (SVRS) of 38 suggests a lower real-world risk compared to its potential severity. The attack requires specific conditions, including the victim logging in through a malicious link hosted on a compromised subdomain. While the vulnerability has been patched in versions 2.46.0, 2.45.1, and 2.44.3, immediate action might not be as critical unless your Zitadel instance is directly exposed to subdomain vulnerabilities or untrusted subdomains. The vulnerability is categorized as CWE-269, indicating improper privilege management, and there is an indication it might be In The Wild.
Description
CVE-2024-28197 affects Zitadel, an open-source identity management system. It involves a vulnerability in the handling of cookies, allowing attackers to gain access to user accounts under specific conditions. The SVRS score of 38 indicates a moderate risk, highlighting the need for attention and timely mitigation.
Key Insights
- Exploitation Requires Specific Conditions: The vulnerability requires a combination of factors, including a malicious link hosted on a subdomain and an initial vulnerability on that subdomain.
- Limited Impact on Existing Sessions: The attack only succeeds if the victim logs in through the malicious link and does not have an existing cookie.
- Self-Hosted Environments Affected: The vulnerability primarily affects self-hosted Zitadel instances that cannot upgrade to patched versions.
Mitigation Strategies
- Upgrade to Patched Versions: Update Zitadel to versions 2.46.0, 2.45.1, or 2.44.3 to resolve the vulnerability.
- Prevent Cookie Setting on Subdomains: For self-hosted environments, prevent the setting of the
__Secure-zitadel-useragentcookie on subdomains using a web application firewall (WAF). - Monitor for Suspicious Activity: Regularly monitor logs and security alerts for any suspicious activity or attempts to exploit the vulnerability.
- Educate Users: Inform users about the vulnerability and advise them to be cautious of suspicious links, especially from subdomains.
Additional Information
- Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
- Exploit Status: Active exploits have not been published.
- CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
- In the Wild: The vulnerability is not known to be actively exploited by hackers.
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.