ZITADEL External JWT Authentication Bypass Vulnerability (CVE-2024-5569) Advisory

Vulnerability Overview An authentication bypass vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation. When validating JSON Web Tokens (JWTs) from external providers, ZITADEL correctly checks the token's cryptographic signature and issuer ( ) claim but fails to validate the audience ( ) claim. As a result, any token with a valid signature is accepted, even if issued by a trusted issuer. An attacker, who could be a legitimate user of an entirely separate service, can intercept or present their token to ZITADEL to successfully impersonate that user. Affected Versions Affected Versions: - ZITADEL 4.0.0 - 4.15.1 - ZITADEL <3.4.11 Fixed Versions: - ZITADEL 4.15.2 - ZITADEL 3.4.12 Remediation Patches: - Upgrade to 4.15.2 - Upgrade to 3.4.12 Workarounds: - If an immediate upgrade to a patched version is not possible, the risk can be mitigated at the infrastructure level: 1. At the IdP side: Ensure the external identity provider issues scope tokens with highly unique, non-overlapping audience values that cannot be misinterpreted by independently deployed services. 2. At the boundary: Deploy a reverse proxy, API gateway, or Web Application Firewall (WAF) in front of ZITADEL to inspect identity tokens and explicitly drop requests where the audience field does not strictly match the ZITADEL deployment target. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: Low - Availability: None CVE ID: CVE-2024-5569 Credits: - Reporter: Android-Login-Analysis - Fix Reviewer: IAM-marco - Fix Developer: Ivica-a - Reporter: Punisher100 Feedback: - For any questions or comments, please send an email to security@zitadel.com Acknowledgments: - Thanks to Android-Login-Analysis, Jason Zhou, and Pedro Gilotto for reporting this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

ZITADEL External JWT Authentication Bypass Vulnerability (CVE-2024-5569) Advisory

More from this source