6.1Media
CVE-2024-8883Keycloak: vulnerable redirect uri validation results in open redirec
Descripción
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Debilidad (CWE):
CWE-601
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| build keycloak | 22 | — | |
| build keycloak | 24 | — | |
| jboss enterprise application platform | 8.0 | — | |
| Red Hat | Red Hat Build of Keycloak | — | |
| Red Hat | Red Hat build of Keycloak 22 | all versions | |
| Red Hat | Red Hat build of Keycloak 24 | all versions | |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | all versions | |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | all versions | |
| red hat single sign on | 7.6 | — | |
| rhosemc | 1.0 | — | |
| — | keycloak-services | < 22.0.12, 23.0.0 – < 24.0.7, 25.0.0 – < 25.0.5 |
Referencias y parches
- RHSA-2024:10385 vendor-advisory
- RHSA-2024:10386 vendor-advisory
- RHSA-2024:6878 vendor-advisory
- RHSA-2024:6879 vendor-advisory
- RHSA-2024:6880 vendor-advisory
- RHSA-2024:6882 vendor-advisory
- RHSA-2024:6886 vendor-advisory
- RHSA-2024:6887 vendor-advisory
- RHSA-2024:6888 vendor-advisory
- RHSA-2024:6889 vendor-advisory
- RHSA-2024:6890 vendor-advisory
- RHSA-2024:8823 vendor-advisory
- RHSA-2024:8824 vendor-advisory
- RHSA-2024:8826 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-8883 vdb-entry
- RHBZ#2312511 issue-tracking
- https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/Redire…