A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.
A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This action is done by modifying any of the security headers and inserting newlines, which causes the Keycloak server to write to a request that has already been terminated, leading to the failure of said request.
A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.
Red Hat has released a security advisory for the Red Hat build of Keycloak addressing two vulnerabilities: CVE-2024-8698, which involves improper verification of SAML responses that can lead to privilege escalation, and CVE-2024-8883, which concerns vulnerable redirect URI validation resulting in open redirect issues. These vulnerabilities affect authentication and single sign-on capabilities. The advisory recommends updating to version 24.0.8 and backing up existing installations before applying the update.
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permission manage-realm) to change the LDAP host URL ("Connection URL") to a machine they control. The Keycloak server will connect to the attacker's host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console or compromised a user with sufficient privileges can leak domain credentials and attack the domain.
A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with this specific Dynamic Client Registration and TrustedDomain configuration previously unauthorized.
A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.
A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to register a false second authentication factor along with an existing one and bypass authentication.
CVE-2024-1249 is a vulnerability in Keycloak's OpenID Connect (OIDC) component, specifically in the checkLoginIframe feature, where unvalidated cross-origin messages can be received. This flaw enables attackers to send a large volume of requests rapidly, potentially causing a denial-of-service (DoS) condition by overwhelming the application's availability. The vulnerability has a CVSS score of 7.4, indicating high severity, with no confidentiality or integrity impact but significant availability impact. Red Hat has issued security advisories providing fixes in their Single Sign-On 7.6.8 release for RHEL 7 and 8, which address this and other related vulnerabilities. The affected Keycloak versions explicitly include 21.1.0 and 23.0.0. No known exploits in the wild have been reported as of the publication date.
CVE-2024-1132 is a path traversal vulnerability in Keycloak affecting clients that use wildcards in the Valid Redirect URIs field. The flaw allows attackers to craft malicious URLs that bypass redirect validation, potentially exposing sensitive information or enabling further attacks. User interaction with the malicious URL is required. Red Hat has released security updates addressing this issue in Red Hat Single Sign-On 7.6.8 for RHEL 7 and 8.