PT-2024-2167 · Red Hat · Keycloak

Mauro Matteo Cascella · Published 2024-02-21 · Updated 2024-07-03 · CVE-2023-6787

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description The issue is related to a flaw in the re-authentication mechanism within Keycloak, specifically in the org.keycloak.authentication module. This flaw allows an attacker to hijack an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login", prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting "Restart login", an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Improper Authentication

Session Fixation

Weakness Enumeration

CWE-613

CWE-287

CWE-384

Related Identifiers

BDU:2024-02081

CVE-2023-6787

GHSA-C9H6-V78W-52WJ

Affected Products

Keycloak

References · 17

• https://github.com/keycloak/keycloak/security/advisories/GHSA-c9h6-v78w-52wj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c9h6-v78w-52wj · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02081 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6787 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1867 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1868 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2254375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6787 · Security Note
• https://access.redhat.com/security/cve/CVE-2023-6787 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://security.snyk.io/vuln/SNYK-RHEL9-RHSSO7KEYCLOAKSERVER-6256338 · Note
• https://security.snyk.io/vuln/SNYK-RHEL7-RHSSO7KEYCLOAKSERVER-6261417 · Note
• https://security.snyk.io/vuln/SNYK-RHEL8-RHSSO7KEYCLOAKSERVER-6258884 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6787 · Note
• https://security.snyk.io/vuln/SNYK-JAVA-ORGKEYCLOAK-6291711 · Note