Zitadel v4.15.2 Security Advisory: JWT Validation/XSS/PKCE Fixes

Vulnerability Overview In Zitadel version v4.15.2, several security vulnerabilities and remediation measures are present. Key issues include validation of JWT IDP and claims, validation, connection handling, event storage, PKCE enforcement for IDP applications, JWT IDP administration, login session handling, custom frontend loading, and HTTP client usage. Impact Scope JWT IDP: Failure to validate and claims may lead to authentication bypass. client_id Validation: Missing validation in the code exchange and refresh token flows may lead to token leakage. Connection Handling: Connection handling issues after migration steps 40, 64, and 70 may affect system stability. Event Storage: Allowing overwrites of event resources may lead to data inconsistency. IDP Application PKCE: Improper application of PKCE by OAuth and OIDC providers may lead to authorization code leakage. JWT IDP Administration: Missing validation may lead to token abuse. Login Sessions: Improper IDP session handling during Passkey registration may lead to session hijacking. Custom Frontend: Custom frontend loading in CSP settings may lead to XSS attacks. HTTP Client: Unnecessary entries in the default deny list may cause security policies to fail. Remediation 1. JWT IDP: Always validate and claims (4925fab). 2. client_id Validation: Validate in code exchange and refresh token flows (5624030). 3. Connection Handling: Fix connection handling issues after migration steps 40, 64, and 70 (e12293, c53d977). 4. Event Storage: Prohibit overwriting event resources (e12261, a939b84). 5. IDP Application PKCE: Enforce PKCE in OAuth and OIDC providers (e12247, ab7c6cd); closes #12036 and #12054. 6. JWT IDP Administration: Manage and validate (999e7bb). 7. Login Sessions: Accept IDP sessions during Passkey registration (d12275, add46e0). 8. Custom Frontend: Load custom frontend from brand settings and allow it in CSP (e12279, f9f561d); closes #11200. 9. HTTP Client: Remove unnecessary entries from the default deny list (e12294, 1ca1fbd); use protected HTTP clients for outbound connections (b6f7808). POC Code or Exploit Code No specific POC code or exploit code is included in the document. Summary Zitadel version v4.15.2 addresses multiple security vulnerabilities through various remediation measures involving JWT IDP, validation, connection handling, event storage, PKCE enforcement for IDP applications, JWT IDP administration, login sessions, custom frontend, and HTTP clients. These measures help enhance the system's security and stability.

Goal Reached Thanks to every supporter — we hit 100%!

Zitadel v4.15.2 Security Advisory: JWT Validation/XSS/PKCE Fixes

More from this source