CyberRota Analysis
AI-GeneratedZitadel versions prior to 4.16.2 are vulnerable to a server-side request forgery (SSRF) flaw that enables attackers to exploit the HTTP verification process, potentially accessing internal resources by registering malicious domains. This vulnerability could allow for internal network scanning and mapping, posing a risk to sensitive data and infrastructure. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized internal access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register domains that redirect to loopback, internal, or cloud metadata addresses to scan ports and map internal networks.