CVE-2024-29891: 
NixOS vulnerability analysis and mitigation

CVE-2024-29891 is a security vulnerability in ZITADEL's avatar upload functionality that was disclosed on March 27, 2024. The vulnerability affects multiple versions of ZITADEL software prior to versions 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17. The issue stems from improper content-type validation in the avatar upload feature, which could allow attackers to upload HTML content disguised as an image (GitHub Advisory).

The vulnerability is classified with a CVSS v3.1 base score of 8.7 (High), with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. The issue arises from a missing check in the content-type validation process during avatar image uploads, allowing malicious HTML content to be uploaded and stored as an image. This vulnerability combines elements of Unrestricted Upload of File with Dangerous Type (CWE-434) and Cross-site Scripting (CWE-79) (NVD).

If successfully exploited, this vulnerability could lead to account takeover in specific scenarios. The impact is particularly severe as it could allow unauthorized access to victim accounts when certain conditions are met. However, the exploit is browser-specific, only affecting Firefox users, while Chrome, Safari, and Edge browsers are not vulnerable to code execution (GitHub Advisory).

The vulnerability requires specific conditions to be exploited: the attacker must have the ability to upload an avatar, the victim must be using Firefox browser, have an active ZITADEL session, and directly open the malicious image in their browser. These requirements make the exploit somewhat complex but still achievable in targeted attacks (GitHub Advisory).

The vulnerability has been patched in multiple ZITADEL versions: 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17. Organizations are strongly recommended to upgrade to these patched versions or later. No workarounds are available, making the upgrade to a patched version the only solution (GitHub Advisory).