PT-2023-31270 · Duo · Duouniversalkeycloakauthenticator

Benjamin Taylor · Published 2023-12-23 · Updated 2024-01-17 · CVE-2023-49594

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DuoUniversalKeycloakAuthenticator version 1.0.7

Description An information disclosure vulnerability exists in the challenge functionality of the DuoUniversalKeycloakAuthenticator plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. This issue is triggered when a user logs into Keycloak using the DuoUniversalKeycloakAuthenticator plugin.

Recommendations For DuoUniversalKeycloakAuthenticator version 1.0.7, consider disabling the challenge functionality of the plugin until a patch is available to prevent the disclosure of sensitive information. Restrict access to the plugin to minimize the risk of exploitation. Avoid using the DuoUniversalKeycloakAuthenticator plugin for user login to Keycloak until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2023-49594

Affected Products

Duouniversalkeycloakauthenticator

References · 12

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1907 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49594 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49594 · Vendor Advisory
• https://github.com/instipod/DuoUniversalKeycloakAuthenticator/releases/tag/1.0.8 · Note
• https://twitter.com/RedPacketSec/status/1739950239711170817 · Twitter Post
• https://t.me/cvenotify/65059 · Telegram Post
• https://t.me/cvenotify/66116 · Telegram Post
• https://twitter.com/CVEnew/status/1738654605180051501 · Twitter Post
• https://t.me/cvenotify/65047 · Telegram Post
• https://t.me/cvenotify/65048 · Telegram Post
• https://twitter.com/Esparta6108713/status/1738659222420947381 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1738671458929332377 · Twitter Post