CVE-2023-47111 ZITADEL race condition in lockout policy execution

High 7.3 Published 8 Nov 2023 Updated 12 Sep 2024

Attackers can bypass lockout policies by executing parallel password checks, allowing more attempts than configured.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-47111?

CVE-2023-47111 is a high-severity vulnerability in zitadel, published on 8 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit, will lock the user and prevent further authentication. In the affected implementation it was possible for an attacker to start multiple parallel password checks, giving him the possibility to try out more combinations than configured in the `Lockout Policy`. This vulnerability has been patched in versions 2.40.5 and 2.38.3.

Weakness: CWE-362

Which versions are affected by CVE-2023-47111?

4 open source packages ship an affected version, including github.com/zitadel/zitadel. It affects 1 product.

Package	Affected	Fixed in
`github.com/zitadel/zitadel` Go	All versions	`2.38.3`
`github.com/zitadel/zitadel` Go	All versions	`2.38.3`
`github.com/zitadel/zitadel` Go	From `2.39.0`	`2.40.5`
`github.com/zitadel/zitadel` Go	From `2.39.0`	`2.40.5`

Products include Zitadel Zitadel.

How do I fix CVE-2023-47111?

Upgrade github.com/zitadel/zitadel to a fixed version for your release line: 2.38.3 or 2.40.5.

Is CVE-2023-47111 being exploited?

There is no known exploitation of CVE-2023-47111 in the wild and no public exploit code.

Sources

Also known as GHSA-7h8m-vrxx-vr4m.