Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

Threatpost

SecurityWeek

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.

CVE-2023-6927 is a vulnerability identified in the Red Hat build of Keycloak version 22, specifically involving an open redirect flaw within the JARM (JWT Secured Authorization Response Mode) response mode "form_post.jwt". This vulnerability arises from the improper handling of wildcards in redirect URIs, which can be exploited by an attacker to bypass the security patch implemented for a prior vulnerability (CVE-2023-6134). By leveraging this flaw, an attacker can redirect authorization responses containing sensitive tokens or authorization codes to untrusted sites, potentially stealing these credentials. The vulnerability requires the attacker to have some privileges (PR:L) and user interaction (UI:R), indicating that exploitation is not fully remote or automatic but feasible in targeted scenarios. The CVSS score of 4.6 (medium severity) reflects the limited impact on availability but notable risks to confidentiality and integrity. The flaw affects the OAuth2/OpenID Connect flows managed by Keycloak, a widely used open-source identity and access management solution, particularly in enterprise environments. No public exploits have been reported yet, but the vulnerability poses a risk to organizations relying on Keycloak for secure authentication and authorization, especially where JARM response modes are used with wildcard redirect URIs.

Detailed information about CVE-2023-6927: URL Redirection to Untrusted Site ('Open Redirect') in Red Hat Red Hat build of Keycloak 22 affecting Red Hat Red Hat 

CVE-2023-6927: URL Redirection to Untrusted Site ('Open Redirect') in Red Hat Red Hat build of Keycloak 22 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-6927: URL Redirection to Untrusted Site ('Open Redirect') in Red Hat Red Hat build of Keycloak 22

Threats Tagged 'cve-2023-6927'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2023-6927'

Lead Pen Test Professional