SB20240417142 - Multiple vulnerabilities in Keycloak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20240417142

SB20240417142 - Multiple vulnerabilities in Keycloak

Published: April 17, 2024

Security Bulletin ID SB20240417142
Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-1249)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to "checkLoginIframe" allows unvalidated cross-origin messages. A remote attacker can send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.


2) Path traversal (CVE-ID: CVE-2024-1132)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to improper validation of URLs included in a redirect in org.keycloak.protocol.oidc. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Note, the vulnerability affects any client that utilizes a wildcard in the Valid Redirect URIs field.


3) Session Fixation (CVE-ID: CVE-2023-6787)

The vulnerability allows a remote attacker to hijack session of another user.

The vulnerability exists due to an error in the re-authentication mechanism in org.keycloak.authentication. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.


4) Insufficient Session Expiration (CVE-ID: CVE-2023-0657)

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to software does not properly enforce token types when validating signatures locally. An authenticated user can use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.


5) Cross-site scripting (CVE-ID: CVE-2023-6717)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the assertion consumer service URL in SAML POST-binding flow. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


6) Path traversal (CVE-ID: CVE-2024-2419)

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to an error in the redirect_uri validation logic within org.keycloak.protocol.oidc.utils. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.


7) Improper authorization (CVE-ID: CVE-2023-6544)

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to a permissive regular expression hard-coded for filtering allowed hosts to register a dynamic client within the org.keycloak.services.clientregistration package. A remote attacker with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized.


8) Improper Authentication (CVE-ID: CVE-2023-3597)

The vulnerability allows a remote user to bypass 2FA authentication process.

The vulnerability exists due to Keycloak does not correctly validate its client step-up authentication in org.keycloak.authentication. A remote user authenticated with password can use this flaw to register a false second authentication factor along with existing one and bypass authentication.


Remediation

Install update from vendor's website.

References