-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description clearly points to an SSRF issue related to the x-zitadel-forward-host header in the ZITADEL Login UI (V2). Analyzing the provided patch commit 4c879b47334e01d4fcab921ac1b44eda39acdb96 reveals significant changes in how the application determines the backend API URL.
The core of the vulnerability lies in the getServiceUrlFromHeaders function within apps/login/src/lib/service-url.ts. This function was responsible for determining the service URL for API calls. The patch shows that this function was completely removed. Its previous implementation prioritized the x-zitadel-forward-host header. If this header was present, its value was used directly to construct the serviceUrl. This serviceUrl was then used throughout the application to make gRPC requests to the ZITADEL backend, creating a classic SSRF vulnerability. An attacker could control the x-zitadel-forward-host header to make the ZITADEL login component send requests to arbitrary internal or external services and exfiltrate the response.
The patch replaces this insecure logic by introducing a new function, getServiceConfig. This new function correctly separates concerns:
ZITADEL_API_URL environment variable, which is a trusted, server-side configuration.x-zitadel-forward-host and other host-related headers are now used to determine the instanceHost and publicHost, which are passed as headers (x-zitadel-instance-host, x-zitadel-public-host) in the API request rather than being part of the URL itself. This allows the backend to handle multi-tenancy routing securely without allowing an attacker to control the request's destination.Therefore, the function getServiceUrlFromHeaders is the specific, identifiable vulnerable function that would be present in runtime profiles of the unpatched application when the vulnerability is triggered.
getServiceUrlFromHeadersapps/login/src/lib/service-url.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel | go | < 1.80.0-v2.20.0.20251208091519-4c879b47334e | 1.80.0-v2.20.0.20251208091519-4c879b47334e |
| github.com/zitadel/zitadel | go | >= 1.83.4, <= 1.87.5 | |
| github.com/zitadel/zitadel | go | >= 4.0.0-rc.1, < 4.7.1 | 4.7.1 |
| github.com/zitadel/zitadel/v2 | go | < 1.80.0-v2.20.0.20251208091519-4c879b47334e | 1.80.0-v2.20.0.20251208091519-4c879b47334e |