CVE-2024-2419 Keycloak: path traversal in the redirect validation

2024-04-1713:23:34

CWE-601

redhat

github.com

keycloak

redirect_uri

validation

token theft

access token

impersonation

cve-2024-2419

cve-2023-6291

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

51.1%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

A flaw was found in Keycloak’s redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291.

CNA Affected

[
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:22::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 22",
    "versions": [
      {
        "status": "unaffected",
        "version": "22.0.10-1",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-operator-bundle",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:22::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 22",
    "versions": [
      {
        "status": "unaffected",
        "version": "22-13",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:22::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 22",
    "versions": [
      {
        "status": "unaffected",
        "version": "22-16",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rhbk/keycloak-rhel9-operator",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  }
]