~ / search / GHSA-72vp-xfrc-42xm

GHSA-72vp-xfrc-42xm

Keycloak path traversal vulnerability in redirection validation

Source: GitHub Advisory Database (reviewed) High CVE-2024-1132

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 22.0.10 22.0.10
Maven org.keycloak:keycloak-services >= 23.0.0, < 24.0.3 24.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field. #### Acknowledgements: Special thanks to Axel Flamcourt for reporting this issue and helping us improve our project.

References

External links from the advisory. They lead to third-party sites.