PT-2021-9721 · Red Hat+1 · Keycloak Gatekeeper+1

Dhananjay Arunesh + 2 · Published 2021-02-23 · Updated 2022-08-10 · CVE-2020-14359

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Keycloak Gatekeeper versions all

Description A vulnerability was found in Keycloak Gatekeeper where an attacker can bypass the Gatekeeper by using lower case HTTP headers, for example, via cURL. This issue is particularly problematic when the Gatekeeper is used in front of certain webservers, such as Jetty, which also accept lower case headers, thereby providing no protection.

Recommendations As a temporary workaround, consider restricting the use of lower case HTTP headers until a patch is available. Avoid using lower case headers in API endpoints, such as /api/v1/login, until the issue is resolved. Restrict access to the Gatekeeper when used in front of a Jetty server to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2020-14359

GHSA-JH6M-3PQW-242H

Affected Products

Jetty

Keycloak Gatekeeper

References · 9

• https://bugzilla.redhat.com/show_bug.cgi?id=1868591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14359 · Security Note
• https://osv.dev/vulnerability/GHSA-jh6m-3pqw-242h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14359 · Vendor Advisory
• https://github.com/keycloak/keycloak/issues/12934 · Note
• https://github.com/keycloak/keycloak-gatekeeper · Note
• https://t.me/cibsecurity/23982 · Telegram Post
• https://issues.jboss.org/browse/KEYCLOAK-14090 · Note
• https://web.archive.org/web/20190613000352/github.com/keycloak/keycloak-gatekeeper · Note