Listen to this Post
The vulnerability exists within the logout endpoint (/logout) of the ZITADEL Login UI (v2). This endpoint accepts a `post_logout_redirect` parameter via a GET request. The client-side JavaScript processing this parameter did not perform proper validation or sanitization on the input value. When a user visits a maliciously crafted logout URL, the unsanitized parameter value is dynamically written into the Document Object Model (DOM). This allows an attacker to inject arbitrary JavaScript code. The injected script is then executed within the security context (origin) of the ZITADEL V2 Login domain. This DOM-based Cross-Site Scripting (XSS) flaw enables complete control over the user’s session within that browser tab, as the script runs with the victim’s permissions on the ZITADEL domain.
Platform: ZITADEL Login UI
Version: v4.0.0-rc.1 to v4.7.0
Vulnerability: DOM-Based XSS
Severity: Critical
date: 2024-XX-XX
Prediction: Patch expected 2024-10-15
What Undercode Say:
curl -v "https://target.zitadel.cloud/logout?post_logout_redirect=javascript:alert(document.domain)//"
<script>fetch('/api/v2/users/me/password', {method:'POST',body:'{"newPassword":"AttackerPwd"}'})</script>
cat payload.txt | qsreplace 'javascript:evil()' | while read host; do http --follow $host; done
How Exploit:
Attacker crafts a malicious URL containing a `post_logout_redirect` parameter with a `javascript:` payload or raw HTML/script injection. The attacker tricks a victim into clicking this link while the victim is authenticated to ZITADEL in the same browser. Upon clicking, the victim is taken to the legitimate ZITADEL logout page where the malicious payload from the URL is rendered and executed. The attacker’s script can perform actions as the victim, such as initiating a password reset or session theft.
Protection from this CVE:
Upgrade to a patched ZITADEL version (post v4.7.0). Ensure the `ZITADEL_API_URL` is correctly configured. Implement the new `logout_token` JWT parameter instead of query parameters. Verify JWT signatures with instance keys (jwks_uri). Ensure reverse proxy passes correct `host` headers.
Impact:
Unauthenticated remote code execution in victim’s browser. Full account takeover possible via password reset. Theft of session cookies and sensitive data. Attack requires multiple active sessions in same browser. Impact reduced for accounts with MFA/Passwordless.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
