-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel/v2 | go | < 2.71.18 | 2.71.18 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the improper handling of HTTP host headers, specifically the Forwarded and X-Forwarded-Host headers. The application used these headers to construct URLs, including for password resets. An attacker could inject a malicious value into these headers (e.g., example.com:@attacker.com) to craft a password reset link that points to an attacker-controlled domain.
The root cause is twofold: first, the lack of input sanitization when reading the header values, and second, the use of unsafe string splitting (strings.Split(host, ":")) to parse the domain from the host. The primary vulnerable function is hostFromRequest in internal/api/http/middleware/origin_interceptor.go, which reads the header value without validation. The patch introduces a sanitizeHost function that uses net.SplitHostPort for robust parsing and validation, preventing the injection.
Other functions like Queries.InstanceByHost and DomainCtx.RequestedDomain were also identified as vulnerable because they contained the same flawed strings.Split parsing logic, making them susceptible to the same type of manipulation. The fix involved removing this logic and relying on correctly parsed and sanitized host information.
hostFromRequestinternal/api/http/middleware/origin_interceptor.go
Queries.InstanceByHostinternal/query/instance.go
DomainCtx.RequestedDomaininternal/api/http/request_context.go
WebAuthNsToCredentialsinternal/webauthn/converter.go
Ongoing coverage of React2Shell