CVE-2022-21706
📋 TL;DR
This vulnerability in Zulip Server allows multi-use invitations created in one organization to be used to join any other organization on the same deployment. This bypasses email domain restrictions, grants unauthorized access to invitation-only organizations, and can provide elevated privileges. Only deployments hosting multiple organizations are affected.
💻 Affected Systems
- Zulip Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains administrative access to all organizations on the deployment, potentially compromising sensitive team communications and data across multiple organizations.
Likely Case
Unauthorized users gain access to organizations they shouldn't have access to, potentially viewing confidential discussions or joining restricted communities.
If Mitigated
With proper monitoring and single-organization deployments, impact is limited to potential unauthorized access within the same organization.
🎯 Exploit Status
Exploitation requires having or obtaining a valid invitation link from any organization on the deployment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.10 and later
Vendor Advisory: https://github.com/zulip/zulip/security/advisories/GHSA-6xmj-2wcm-p2jc
Restart Required: Yes
Instructions:
1. Backup your Zulip installation and database. 2. Upgrade to Zulip Server 4.10 or later using standard upgrade procedures. 3. Restart the Zulip service. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
No workarounds available
allThe vendor states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Migrate to single-organization deployments if possible
- Disable invitation functionality entirely
🔍 How to Verify
Check if Vulnerable:
Check if running Zulip Server version 2.0.0 through 4.9 and hosting multiple organizations.Check Version:
Check /var/log/zulip/server.log or run: /home/zulip/deployments/current/scripts/get-django-setting VERSIONVerify Fix Applied:
Verify Zulip Server version is 4.10 or later and test that invitations are properly restricted to their originating organization.📡 Detection & Monitoring
Log Indicators:
- Unusual invitation acceptance patterns
- Users joining organizations without proper invitation audit trails
- Failed invitation attempts across organization boundaries
Network Indicators:
- Unexpected API calls to invitation endpoints from unauthorized sources
SIEM Query:
source="zulip" AND (event="invitation_accepted" OR event="user_joined") | stats count by organization, user_email🔗 References
- https://blog.zulip.com/2022/02/25/zulip-cloud-invitation-vulnerability/
- https://blog.zulip.com/2022/02/25/zulip-server-4-10-security-release/#cve-2022-21706
- https://github.com/zulip/zulip/commit/88917019f03860609114082cdc0f31a561503f9e
- https://github.com/zulip/zulip/security/advisories/GHSA-6xmj-2wcm-p2jc
- https://blog.zulip.com/2022/02/25/zulip-cloud-invitation-vulnerability/
- https://blog.zulip.com/2022/02/25/zulip-server-4-10-security-release/#cve-2022-21706
- https://github.com/zulip/zulip/commit/88917019f03860609114082cdc0f31a561503f9e
- https://github.com/zulip/zulip/security/advisories/GHSA-6xmj-2wcm-p2jc
