CVE-2024-29891 ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass
Attackers can upload malicious HTML disguised as images to execute scripts in victim browsers, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-29891?
CVE-2024-29891 is a high-severity cross-site scripting vulnerability in zitadel, published on 27 Mar 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed image in the browser, where a session in ZITADEL needs to be active for this exploit to work. The exploit could only be reproduced if the victim was using Firefox. Chrome, Safari as well as Edge did not execute the code. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17.
Which versions are affected by CVE-2024-29891?
15 open source packages ship an affected version, including github.com/zitadel/zitadel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zitadel/zitadel Go | All versions | None |
github.com/zitadel/zitadel Go | All versions | 2.42.17 |
github.com/zitadel/zitadel Go | All versions | 2.42.17 |
github.com/zitadel/zitadel Go | From 2.43.0 | 2.43.11 |
github.com/zitadel/zitadel Go | From 2.43.0 | 2.43.11 |
github.com/zitadel/zitadel Go | From 2.44.0 | 2.44.7 |
9 more packages
github.com/zitadel/zitadel Go | From 2.44.0 | 2.44.7 |
github.com/zitadel/zitadel Go | From 2.45.0 | 2.45.5 |
github.com/zitadel/zitadel Go | From 2.45.0 | 2.45.5 |
github.com/zitadel/zitadel Go | From 2.46.0 | 2.46.5 |
github.com/zitadel/zitadel Go | From 2.46.0 | 2.46.5 |
github.com/zitadel/zitadel Go | From 2.47.0 | 2.47.8 |
github.com/zitadel/zitadel Go | From 2.47.0 | 2.47.8 |
github.com/zitadel/zitadel Go | From 2.48.0 | 2.48.3 |
github.com/zitadel/zitadel Go | From 2.48.0 | 2.48.3 |
Products include Zitadel Zitadel.
How do I fix CVE-2024-29891?
Upgrade github.com/zitadel/zitadel to a fixed version for your release line: 2.42.17, 2.43.11, 2.44.7 or 2.45.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-29891 being exploited?
There is no known exploitation of CVE-2024-29891 in the wild and no public exploit code.
Other vulnerabilities in zitadel
- CVE-2026-29191 ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
- CVE-2025-67494 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
- CVE-2025-27507 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
- CVE-2025-64103 Zitadel Bypass Second Authentication Factor
- CVE-2025-31123 Zitadel Expired JWT Keys Usable for Authorization Grants
Sources
Also known as GHSA-hr5w-cwwq-2v4m, GO-2024-2665.