PT-2024-2635 · Red Hat · Rh-Sso+2

Patrick Del Bello · Published 2024-02-28 · Updated 2025-01-21 · CVE-2024-0560

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 3Scale versions used with Keycloak 15 (or RHSSO 7.5.0)

Description The issue is related to incorrect handling of insufficient permissions or privileges in the 3Scale API Management software. When the auth type is set to use 3scale oidc issuer endpoint, the Token Introspection policy fails to inspect tokens due to the removal of the token introspection endpoint field in RH-SSO 7.5. As a result, the policy determines that all tokens are valid. This could allow a remote attacker to execute arbitrary code.

Recommendations For 3Scale versions used with Keycloak 15 (or RHSSO 7.5.0), consider disabling the use 3scale oidc issuer endpoint auth type until a patch is available to prevent the Token Introspection policy from incorrectly validating tokens. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-280

Related Identifiers

BDU:2024-02702

CVE-2024-0560

Affected Products

3Scale

Keycloak

Rh-Sso

References · 10

• https://github.com/3scale/APIcast/pull/1438 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=2258456 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02702 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0560 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2024-0560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0560 · Security Note
• https://twitter.com/CVEnew/status/1762883642781581605 · Twitter Post
• https://t.me/cvenotify/72693 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1762926611173634051 · Twitter Post
• https://t.me/cvenotify/72576 · Telegram Post