SB2024112532 - Multiple vulnerabilities in Keycloak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024112532

SB2024112532 - Multiple vulnerabilities in Keycloak

Published: November 25, 2024

Security Bulletin ID SB2024112532
Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 20% Medium 60% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Improper Authentication (CVE-ID: CVE-2024-10039)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the authentication process in the Keycloak deployments with a reverse proxy not using pass-through termination of TLS and with enabled mTLS. A remote attacker can authenticate as any user or client that leverages mTLS as the authentication mechanism.


2) Input validation error (CVE-ID: CVE-2024-9666)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of HTTP proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service.


3) External Control of File Name or Path (CVE-ID: CVE-2024-10492)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to application allows to read files onside of its scope. A remote privileged user can read sensitive information from a Vault file that is not within the expected context.


4) Incorrect Regular Expression (CVE-ID: CVE-2024-10270)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions in SearchQueryUtils method. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.


5) Information disclosure (CVE-ID: CVE-2024-10451)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to application includes values of environment variables during its build process. These values are stored as default values and are accessible during application's runtime. A remote attacker can gain access to sensitive information.


Remediation

Install update from vendor's website.

References