CVE-2024-32967
📋 TL;DR
Zitadel identity management system versions before patched releases could expose database connection details (database name, username, hostname) to users when database connectivity fails. This information disclosure vulnerability affects all Zitadel deployments with database connectivity issues. Users of affected versions are vulnerable until they upgrade.
💻 Affected Systems
- Zitadel
📦 What is this software?
Zitadel by Zitadel
Zitadel by Zitadel
Zitadel by Zitadel
Zitadel by Zitadel
Zitadel by Zitadel
Zitadel by Zitadel
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain database credentials and host information, potentially leading to database compromise, data exfiltration, or lateral movement to database servers.
Likely Case
Database connection information is exposed to users during database outages, revealing infrastructure details that could aid targeted attacks.
If Mitigated
No sensitive information is exposed; users receive generic error messages without infrastructure details.
🎯 Exploit Status
Exploitation requires causing or waiting for database connectivity failure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.45.7, v2.46.7, v2.47.10, or v2.48.5
Vendor Advisory: https://github.com/zitadel/zitadel/releases
Restart Required: Yes
Instructions:
1. Identify current Zitadel version. 2. Upgrade to appropriate patched version based on your release branch. 3. Restart Zitadel service.
🔧 Temporary Workarounds
No workaround available
allVendor states no workaround exists; patch is required.
🧯 If You Can't Patch
- Ensure database connectivity is highly reliable with redundancy to minimize outage windows.
- Implement network segmentation to isolate database servers from potential attackers.
🔍 How to Verify
Check if Vulnerable:
Check Zitadel version against affected versions list; test by simulating database connectivity failure and observing error responses.Check Version:
Check Zitadel version via web interface or configuration files; exact command depends on deployment method.Verify Fix Applied:
After upgrade, simulate database connectivity failure and confirm error messages no longer contain database connection details.📡 Detection & Monitoring
Log Indicators:
- Error logs containing database connection failure messages with exposed credentials or hostnames
- Unusual database connectivity errors followed by user access
Network Indicators:
- Increased error responses from Zitadel during database outages
SIEM Query:
source="zitadel" AND (error OR failure) AND (database OR db) AND (credentials OR hostname OR username)🔗 References
- https://github.com/zitadel/zitadel/commit/b918603b576d156a08b90917c14c2d019c82ffc6
- https://github.com/zitadel/zitadel/releases/tag/v2.45.7
- https://github.com/zitadel/zitadel/releases/tag/v2.46.7
- https://github.com/zitadel/zitadel/releases/tag/v2.47.10
- https://github.com/zitadel/zitadel/releases/tag/v2.48.5
- https://github.com/zitadel/zitadel/releases/tag/v2.49.5
- https://github.com/zitadel/zitadel/releases/tag/v2.50.3
- https://github.com/zitadel/zitadel/security/advisories/GHSA-q5qj-x2h5-3945
- https://github.com/zitadel/zitadel/commit/b918603b576d156a08b90917c14c2d019c82ffc6
- https://github.com/zitadel/zitadel/releases/tag/v2.45.7
- https://github.com/zitadel/zitadel/releases/tag/v2.46.7
- https://github.com/zitadel/zitadel/releases/tag/v2.47.10
- https://github.com/zitadel/zitadel/releases/tag/v2.48.5
- https://github.com/zitadel/zitadel/releases/tag/v2.49.5
- https://github.com/zitadel/zitadel/releases/tag/v2.50.3
- https://github.com/zitadel/zitadel/security/advisories/GHSA-q5qj-x2h5-3945
