PT-2023-7514 · Red Hat · Keycloak
Pedro Sampaio
·
Publicado
2023-11-07
·
Atualizado
2024-07-06
·
CVE-2023-6484
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Keycloak version 22.0.5
Description
A log injection flaw was found in Keycloak, related to the WebAuthn authentication mode. This issue allows a text string to be injected through the authentication form, which may have a minor impact on the logs' integrity. The flaw is caused by errors in the browser client during setup or authentication with "Security Key login" (WebAuthn) being written into the form, sent to Keycloak, and logged without escaping, thus allowing log injection.
Recommendations
For Keycloak version 22.0.5, consider disabling the WebAuthn authentication mode until a patch is available to prevent potential log injection attacks. Restrict access to the authentication form to minimize the risk of exploitation. Avoid using the WebAuthn authentication mode until the issue is resolved.
Correção
Special Elements Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Keycloak