CVE-2022-36051 Explained : Impact and Mitigation

A detailed analysis of the CVE-2022-36051 vulnerability in ZITADEL Actions.

Understanding CVE-2022-36051

This section covers what CVE-2022-36051 is and its impact.

What is CVE-2022-36051?

The CVE-2022-36051 vulnerability involves broken authorization in ZITADEL Actions, allowing users to grant authorizations for projects belonging to other organizations within the same instance, due to a missing authorization check.

The Impact of CVE-2022-36051

The impact of this vulnerability is considered high, with a CVSS base score of 8.7. It has a high severity level affecting confidentiality, integrity, and privileges required.

Technical Details of CVE-2022-36051

In this section, we delve into the vulnerability description, affected systems, and exploitation mechanism.

Vulnerability Description

Actions introduced in ZITADEL 1.42.0 on the API and 1.56.0 for Console enable users with the

ORG_OWNER

role to create Javascript Code. This could grant authorizations for projects across organizations in the same instance due to the missing authorization check.

Affected Systems and Versions

The vulnerability impacts ZITADEL versions >= 2.0.0 and < 2.2.0, along with versions >= 1.42.0 and < 1.87.1, leaving these systems susceptible to unauthorized grants.

Exploitation Mechanism

Due to the missing authorization check, users with the

ORG_OWNER

role can exploit the Actions feature to grant authorizations for projects from different organizations within the same ZITADEL instance.

Mitigation and Prevention

This section covers immediate steps to take and long-term security practices to mitigate the CVE-2022-36051 vulnerability.

Immediate Steps to Take

Users are advised to update their ZITADEL instances to versions that include the necessary authorization checks for Actions, thereby preventing unauthorized grants.

Long-Term Security Practices

Implementing access controls, regular security audits, and monitoring practices can enhance the overall security posture of ZITADEL instances.

Patching and Updates

Regularly applying security patches and updates released by the vendor is crucial to addressing known vulnerabilities and enhancing system security.