CVE-2023-46238
📋 TL;DR
This vulnerability in ZITADEL allows attackers to inject malicious JavaScript into SVG avatar images, potentially enabling account takeover when victims view the image with an active single session. It affects ZITADEL users who upload custom avatar images. The attack requires specific conditions: victim must have exactly one active session and directly open the malicious image.
💻 Affected Systems
- ZITADEL
📦 What is this software?
Zitadel by Zitadel
Zitadel by Zitadel
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover allowing attacker to impersonate victim, access sensitive identity data, and perform privileged actions within the identity management system.
Likely Case
Limited account compromise in targeted attacks where attackers can trick specific users into viewing malicious SVG avatars under precise session conditions.
If Mitigated
No impact if patched versions are used or if security headers prevent SVG script execution.
🎯 Exploit Status
Exploit requires attacker to upload malicious SVG and victim to view it with exactly one active session. No authentication bypass needed for upload if user upload functionality exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.38.2 or 2.39.2
Vendor Advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-954h-jrpm-72pm
Restart Required: Yes
Instructions:
1. Backup your ZITADEL instance and data. 2. Stop ZITADEL service. 3. Update to version 2.38.2 (for 2.38.x branch) or 2.39.2 (for 2.39.x branch). 4. Restart ZITADEL service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Disable SVG avatar uploads
allConfigure ZITADEL to reject SVG files for avatar uploads
Configure ZITADEL settings to restrict allowed avatar file types to exclude SVG
Implement Content Security Policy
allAdd security headers to prevent SVG script execution
Add Content-Security-Policy header with script-src 'self' or similar restrictions
🧯 If You Can't Patch
- Disable user avatar upload functionality entirely
- Implement WAF rules to block SVG files with script tags or javascript content
🔍 How to Verify
Check if Vulnerable:
Check ZITADEL version: if below 2.38.2 or 2.39.2, you are vulnerable. Also check if SVG avatar uploads are enabled.Check Version:
Check ZITADEL admin interface or run: docker inspect zitadel | grep version (if containerized) or check application logs for version info.Verify Fix Applied:
Verify ZITADEL version is 2.38.2 or higher (for 2.38.x) or 2.39.2 or higher (for 2.39.x). Test SVG upload with script content to ensure it's blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads
- Multiple failed login attempts from same user
- User session anomalies
Network Indicators:
- SVG files with script tags being uploaded
- Unexpected JavaScript execution from avatar endpoints
SIEM Query:
source="zitadel" AND (event="file_upload" AND file_type="svg") OR (event="auth" AND result="failure")🔗 References
- https://github.com/zitadel/zitadel/releases/tag/v2.38.2
- https://github.com/zitadel/zitadel/releases/tag/v2.39.2
- https://github.com/zitadel/zitadel/security/advisories/GHSA-954h-jrpm-72pm
- https://github.com/zitadel/zitadel/releases/tag/v2.38.2
- https://github.com/zitadel/zitadel/releases/tag/v2.39.2
- https://github.com/zitadel/zitadel/security/advisories/GHSA-954h-jrpm-72pm
