CVE-2024-39683: 
NixOS vulnerability analysis and mitigation

ZITADEL, an open-source identity infrastructure tool, disclosed a vulnerability (CVE-2024-39683) affecting versions 2.53.0 through 2.55.0. The vulnerability was discovered in July 2024 and relates to the system's user session management functionality. The issue allows users to view sessions without proper authorization checks, potentially exposing other users' session information (GitHub Advisory).

The vulnerability stems from a missing check in the ListMyUserSessions functionality from the AuthService. When users list their sessions through the API or Console UI, the system incorrectly displayed sessions without proper fingerprint ID verification, including those created through the session service. The issue has been assigned a CVSS v3.1 base score of 5.7 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N, indicating network accessibility with low attack complexity (GitHub Advisory).

The vulnerability could expose session information of other users when listing sessions through the API and Console UI. However, it's important to note that the Login UI was not affected, and there was no possibility to take over exposed sessions. The issue primarily impacts data confidentiality without affecting system integrity or availability (GitHub Advisory).

The vulnerability requires network access and low attack complexity to exploit. An attacker needs low privileges and user interaction to successfully exploit the vulnerability. The scope is unchanged, meaning the impact is limited to the vulnerable component's security scope (GitHub Advisory).

The vulnerability has been patched in versions 2.53.8, 2.54.5, and 2.55.1. ZITADEL recommends upgrading to these or later versions. The fix involves correctly setting user agent/fingerprint IDs on user sessions and implementing proper checks for session listing. No workarounds are available as patches have already been released (GitHub Advisory, GitHub Release).

The vulnerability was responsibly disclosed and addressed through coordinated efforts between the security researchers and ZITADEL team. Credit for discovering and reporting the vulnerability goes to multiple researchers including cybertransformer, Avolicious, AmirhoseinBrz, and srividyaj (GitHub Advisory).