PT-2023-32593 · Red Hat · Keycloak

Rohit Keshri · Published 2023-12-19 · Updated 2024-04-17 · CVE-2023-6291

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in the redirect uri validation logic in Keycloak, which may allow a bypass of otherwise explicitly allowed hosts. This issue arises due to a desynchronization in how Keycloak and browsers interpret URLs, specifically in the verifyRedirectUri method. The validation logic is performed on a URL decoded version, which no longer represents the original input. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Open Redirect

Weakness Enumeration

CWE-20

CWE-601

Related Identifiers

CVE-2023-6291

GHSA-MPWQ-J3XF-7M5W

RHSA-2023:7854

RHSA-2023:7855

RHSA-2023:7856

RHSA-2024:0798

RHSA-2024:0799

RHSA-2024:0800

Affected Products

Keycloak

References · 28

• https://access.redhat.com/errata/RHSA-2024:0798 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:0804 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:0800 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7861 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7855 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2251407 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7858 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-6291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6291 · Security Note
• https://osv.dev/vulnerability/GHSA-mpwq-j3xf-7m5w · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7857 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7860 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7854 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6291 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7856 · Vendor Advisory