Description
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected products
- RedHat / build_of_keycloak
- RedHat / openshift_container_platform4.11 – 4.11
- RedHat / openshift_container_platform4.12 – 4.12
- RedHat / openshift_container_platform_for_ibm_z4.9 – 4.9
- RedHat / openshift_container_platform_for_ibm_z4.10 – 4.10
- RedHat / openshift_container_platform_for_linuxone4.9 – 4.9
- RedHat / openshift_container_platform_for_linuxone4.10 – 4.10
- RedHat / openshift_container_platform_for_power4.9 – 4.9
- RedHat / openshift_container_platform_for_power4.10 – 4.10
- RedHat / single_sign-on
- RedHat / single_sign-on7.6 – 7.6
Exploits & proofs of concept
- nucleiKeycloak - Open Redirectby iamnoooob,rootxharsh,pdresearch
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:10385
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:10386
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:6878
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:6879
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:6880
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:6882
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:6886
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:6887
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:6888
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:6889
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:6890
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8823
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8824
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:8826
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2024-8883
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2312511
- MISChttps://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java
Updated 5m ago · 8 sources