Ziti Admin Console (ZAC) Node server: unauthenticated /api/schema endpoint allows arbitrary file read and SSRF

Security Adivsories
1

Summary

The ZAC Node backend exposes an unauthenticated POST /api/schema endpoint that dereferences a caller-supplied JSON schema with external reference resolution enabled. This lets an unauthenticated attacker make the server read local files (returned in the response) or issue server-side requests to arbitrary URLs (SSRF).

Affected Component

  • Package: openziti/ziti-console (Ziti Admin Console) — Node backend
  • File: server.js — the /api/schema handler
  • Sink: @apidevtools/json-schema-ref-parser dereference() run on the request body with file and http $ref resolvers enabled

Vulnerability Class

  • Primary: CWE-306 — Missing Authentication for Critical Function
  • Secondary: CWE-22 — Improper Limitation of a Pathname (arbitrary file read); CWE-918 — Server-Side Request Forgery

Attacker Model

An unauthenticated remote attacker with network access to the ZAC Node server. No credentials and no user interaction are required.

Preconditions

ZAC running via the Node backend (server.js) in node-api or classic mode — the default container entrypoint. Deployments that serve only the static Angular application are not affected.

Root Cause

/api/schema passes the request body straight into json-schema-ref-parser's dereference() with its default resolvers enabled. A $ref pointing at a local file path makes the server read that file and return its contents; a $ref pointing at an http/https URL makes the server fetch it.

Impact

Unauthenticated read of JSON/YAML-parseable files the ZAC process can access, including the runtime settings.json (SMTP credentials) and session files (controller session tokens), and SSRF from the ZAC host into reachable internal services.

  • CVSS v3.1: 8.6 (High)
  • Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Not impacted: static-only (SPA) deployments that never run server.js; no remote code execution.

Package

openziti/ziti-console (app-ziti-console, Node backend / node-api mode)

Affected Versions

  • app-ziti-console < 4.5.3

Patched Versions

  • app-ziti-console 4.5.3

Remediation

Upgrade to 4.5.3, which removes the unused /api/schema handler and its json-schema-ref-parser import (the console resolves schema references in the browser, so the endpoint was dead code). If you cannot upgrade, block POST /api/schema at a reverse proxy, or run ZAC in static-asset (SPA) mode instead of the Node proxy.

References

Credits

Reported by dmuensterer and sajdakabir.