CyberRota Analysis
AI-GeneratedZITADEL versions 3.0.0 to 3.4.13 and 4.16.1 are vulnerable due to an unrestricted filesystem source loader in the Actions V1 component, allowing users with specific permissions to execute JavaScript and access sensitive configuration files and credentials. This vulnerability can lead to the disclosure of critical secrets and potential escalation from organization administrator to instance administrator. Organizations using affected versions should prioritize upgrading to 3.4.13 or 4.16.1 to mitigate the risks associated with this high-severity issue.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1.