#VU93095 Information disclosure in Keycloak - CVE-2024-5967

Vulnerability identifier: #VU93095

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-5967

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Keycloak
Server applications / Directory software, identity management

Vendor: Keycloak

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to the LDAP testing endpoint allows to change the Connection URL independently of and without having to re-enter the currently configured LDAP bind credentials. A remote privileged user can modify the LDAP host URL ("Connection URL") to the attacker-controlled system and force the application to send credentials to a malicious server.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Keycloak: 20.0.0 - 25.0.0

---

External links
https://access.redhat.com/security/cve/CVE-2024-5967
https://bugzilla.redhat.com/show_bug.cgi?id=2292200
https://github.com/keycloak/keycloak/security/advisories/GHSA-c25h-c27q-5qpv

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.