mirror of
https://github.com/zitadel/zitadel.git
synced 2026-11-03 20:56:50 -06:00
Marco A.andLivio Spring
b6f7808691
# Which Problems Are Solved
Backchannel logout, notification webhooks and SAML metadata URL fetches are vulnerable to SSRF attacks: the attacker can set any URL as backchannel logout URL, potentially pointing to resources on the server running Zitadel.
Additionally existing denylist usage was vulnerable against DNS rebinding, redirect and HTTPs downgrades and missed some common default entries.
# How the Problems Are Solved
- Added an HTTPClient configuration to allow initiating a single HTTP client using one denylist, timeout, redirect and downgrade settings. The client is passed into every component requiring an outgoing http connection (apart from ServicePing and Sonyflake machine id resolver).
- Added a `NewHTTPTransport` function returning an http.Roundtripper to check the denylist using `Control`, which is called before `Dial` to prevent DNS rebinding attacks / TOCTOC gaps.
- The HTTP Client also uses an `io.LimitReader` wrapper with a configurable `MaxBodySize` to prevent OOM issues or even DOS attacks by components reading the whole body without limit.
- Implement a dynamic denylist: it is now possible to define as many denylists as needed. You just need to define a denylist target and assign it to your denylist.
- Propagate the usage of global denylists to all places making use of existing deny lists.
- Block creation of OIDC apps if selected backchannel logout URL is in the denylist
- Block workers using backchannel logout URLs that are in the denylist.
- Implement the same concept for webhooks (email and sms)
- Implement the same concept for SAML metadata URL fetches
# Additional Context
- Closes https://github.com/zitadel/zitadel/security/advisories/GHSA-29jh-8cfq-rr8x
---------
Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com>
(cherry picked from commit 8e82ec1cb9)