CVE-2025-53895

Executive Summary

CVE-2025-53895 is a critical authorization bypass vulnerability in ZITADEL, an open-source identity management system. The flaw resides in the session management API, where a missing permission check allows any authenticated user to update a session if they know its ID. This enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. The vulnerability affects versions starting from 2.53.0 up to the fixed versions (2.70.14, 2.71.13, 3.3.2, and 4.0.0-rc.2). No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

ZITADEL is distributed as a Go binary and Docker image. Organizations using ZITADEL should verify their deployment version and update to a patched release immediately. The vulnerability does not affect the software supply chain itself but rather the runtime authorization logic.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0 (unassigned). Based on the vulnerability description, a reasonable CVSS vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) - requires any authenticated user
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)

Estimated CVSS Score: 8.1 (High)

Threat Level: High. The vulnerability allows session hijacking with low complexity and no user interaction, leading to full user impersonation.

Deep Dive & Mechanics

The vulnerability exists in the session management API endpoint that handles session updates. In affected versions (>= 2.53.0), the API does not verify that the authenticated user has permission to modify the target session. The only requirement is knowledge of the session ID.

Root Cause: Missing authorization check in the session update handler. The code likely retrieves the session by ID and applies updates without verifying that the requesting user owns or has permission to modify that session.

Attack Flow:

1. Attacker authenticates to ZITADEL (obtains a valid session token).
2. Attacker obtains a target user's session ID (e.g., through information disclosure, logging, or other means).
3. Attacker sends a request to the session update API endpoint with the target session ID and desired modifications (e.g., extending session expiry, changing associated claims).
4. The server processes the update without checking permissions, effectively hijacking the target session.

Impact: Full user impersonation, access to sensitive resources, privilege escalation if the target user has higher privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

func (h *SessionHandler) UpdateSession(w http.ResponseWriter, r *http.Request) {
    sessionID := r.URL.Query().Get("sessionID")
    // Missing permission check
    session, err := h.store.GetSession(sessionID)
    if err != nil {
        // handle error
    }
    // Apply updates from request body
    err = h.store.UpdateSession(session)
    // ...
}

Patched Code (Conceptual):

func (h *SessionHandler) UpdateSession(w http.ResponseWriter, r *http.Request) {
    sessionID := r.URL.Query().Get("sessionID")
    userID := GetAuthenticatedUserID(r)
    
    // Permission check: verify user owns the session
    session, err := h.store.GetSession(sessionID)
    if err != nil {
        // handle error
    }
    if session.UserID != userID {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    // Apply updates from request body
    err = h.store.UpdateSession(session)
    // ...
}

The fix adds a check to ensure the authenticated user is the owner of the session being updated.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a ZITADEL instance running a vulnerable version (>= 2.53.0 and < fixed versions).
• Valid credentials for any user on the instance.
• Knowledge of a target user's session ID.

Exploitation Steps:

1. Authenticate to ZITADEL and obtain your own session token.
2. Obtain a target session ID (e.g., through log inspection, API enumeration, or social engineering).
3. Send a crafted request to the session update API:

   POST /api/v1/sessions/{target_session_id}/update HTTP/1.1
   Host: zitadel.example.com
   Authorization: Bearer <your_token>
   Content-Type: application/json
   
   {
     "expiration": "2099-12-31T23:59:59Z",
     "claims": {
       "sub": "target_user_id",
       "role": "admin"
     }
   }
   

4. The server updates the session, allowing you to use the target session for subsequent requests.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual session update requests where the authenticated user does not match the session owner.
• Alert on multiple session update attempts for different session IDs from the same user.
• Review logs for session.update events with unexpected user-to-session mappings.

Hunting:

• Query logs for session.update actions where user_id != session.user_id.
• Look for patterns of session updates occurring shortly after authentication.

Prevention:

• Apply the patch immediately.
• Implement additional monitoring on session management endpoints.
• Use short session timeouts and require re-authentication for sensitive actions.

Indicators of Compromise (IOCs)

• Network: Unusual API requests to /api/v1/sessions/*/update with mismatched user IDs.
• Logs: session.update events where the authenticated user does not own the session.
• Behavior: Multiple session updates from a single user targeting different session IDs.
• Session: Sessions with unexpected expiration times or claims modifications.

Detection Engineering

YARA Rule

rule CVE_2025_53895_Session_Hijack {
    meta:
        description = "Detects potential exploitation of CVE-2025-53895 in ZITADEL logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53895"
    strings:
        $s1 = "session.update" ascii wide nocase
        $s2 = "user_id" ascii wide nocase
        $s3 = "session_id" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2025-53895 - ZITADEL Session Hijacking Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit missing permission check in ZITADEL session update API
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-53895
logsource:
    product: zitadel
    service: audit
detection:
    selection:
        action: "session.update"
        user_id|neq: session.user_id
    condition: selection
falsepositives:
    - Legitimate session updates by administrators (if applicable)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-53895 - ZITADEL Session Hijacking Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/v1/sessions/"; http_uri; content:"/update"; http_uri; pcre:"/\/api\/v1\/sessions\/[a-f0-9\-]+\/update/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ZITADEL to one of the fixed versions: 2.70.14, 2.71.13, 3.3.2, or 4.0.0-rc.2.
2. If immediate upgrade is not possible, restrict access to the session management API using network policies or reverse proxy rules.
3. Review and rotate all existing session tokens.

Long-term Measures:

• Implement additional authorization checks for all session management endpoints.
• Enable comprehensive audit logging for session operations.
• Regularly review and update access control policies.
• Conduct security training for developers on proper authorization implementation.

Workarounds:

• Disable the session update API endpoint if not required.
• Implement a Web Application Firewall (WAF) rule to block requests with mismatched user/session IDs.

Valters IT
Securing Digital Identities