Vulnerability Discovery
During an assessment of a Zitadel deployment, it was found that SVG files could be uploaded as user avatars. While Zitadel applies a strict Content Security Policy (CSP) on its main dashboard pages, the endpoint responsible for serving uploaded files had no CSP restrictions. Additionally, these files were served without a header that would normally force them to be downloaded, meaning they could be displayed and executed within the browser, under Zitadel’s domain.
Further research revealed that if JavaScript was executed in this context, it could interact with Zitadel’s authentication system. Specifically, it could request a new OAuth token, and then use that token to generate a passwordless login link. This link could then be silently sent to an attacker-controlled server, effectively enabling a stealthy account takeover.
Zitadel was also found to allow emails to be sent with highly customisable content. By injecting crafted HTML into user input fields (like “Family Name”), attackers could manipulate the layout and content of emails. This technique could be used to deliver malicious links to unsuspecting users via trusted-looking emails, making the exploit even more effective. The Zitadel team acknowledged the email injection as a known vulnerability that was not newly introduced (commonly referred to as an “N-day” issue).
Proof of Concepts
Silent Account Takeover
A proof-of-concept demonstrated that:
- An attacker could upload an SVG file containing JavaScript as a user avatar.
- When this image was viewed, the JavaScript would initiate an OAuth authorisation process, obtain an access token, and then use Zitadel’s own APIs to create a passwordless login link tied to the victim’s account.
- This link would then be sent to a server controlled by the attacker, allowing them to log in without a password.
- This attack did not rely on tricking the user to click anything — the process happened silently once the image was loaded.
- A simpler version of this exploit could be used to exfiltrate only the OAuth access token, which would also allow the attacker to act as the user.
Email Injection
It was also demonstrated that Zitadel’s email templates could be manipulated using HTML inserted into fields like the user’s “Family Name”. For instance, adding certain HTML tags could terminate sections of the email early or hide legitimate content, allowing the attacker to craft an email that appears entirely normal and trustworthy to the recipient — while actually containing only attacker-controlled content.
Potential Impact
These vulnerabilities combined could allow for:
- Complete account takeover, without any password knowledge or user interaction
- Delivery of malicious emails using Zitadel’s own infrastructure
- Phishing-like attacks that appear to come from a legitimate source
How to Fix
Zitadel has resolved these issues. Users should update to one of the patched versions:
- Version 2.28.2
- Version 2.39.2
More information is available on Zitadel’s official security advisory page.
Vulnerability Disclosure Timeline
- 12 October 2023 – Stored XSS vulnerability reported to the vendor
- 13 October 2023 – Vendor responded to the initial report
- 13 October 2023 – Email injection vulnerability also disclosed
- 16 October 2023 – Vendor acknowledged email injection and requested proof of impact for the XSS
- 19 October 2023 – Proof-of-concept for silent account takeover submitted
- 19 October 2023 – Vendor acknowledged the PoC and started further investigation
- 25 October 2023 – Vendor continued assessing the impact
- 26 October 2023 – Issues were patched, a security advisory was published, and a CVE identifier was issued
