Description
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected products
- RedHat / build_of_keycloak
- RedHat / jboss_middleware_text-only_advisories1.0 – 1.0
- RedHat / keycloak21.1.0 – 22.0.10
- RedHat / migration_toolkit_for_applications1.0 – 1.0
- RedHat / migration_toolkit_for_runtimes
- RedHat / openshift_container_platform4.11 – 4.11
- RedHat / openshift_container_platform4.12 – 4.12
- RedHat / openshift_container_platform_for_ibm_z4.9 – 4.9
- RedHat / openshift_container_platform_for_ibm_z4.10 – 4.10
- RedHat / openshift_container_platform_for_linuxone4.9 – 4.9
- RedHat / openshift_container_platform_for_linuxone4.10 – 4.10
- RedHat / openshift_container_platform_for_power4.9 – 4.9
- RedHat / openshift_container_platform_for_power4.10 – 4.10
- RedHat / single_sign-on
- RedHat / single_sign-on7.6 – 7.6
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:1860
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:1861
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:1862
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:1864
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:1866
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:1867
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:1868
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:2945
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:3752
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:3762
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:3919
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:3989
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2024-1132
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2262117
Updated 5m ago · 8 sources