~ / search / GHSA-f4v7-3mww-9gc2

GHSA-f4v7-3mww-9gc2

Keycloak allows unrestricted admin use of system and environment variables

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-11736

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-quarkus-server < 26.0.8 26.0.8

Details

As written in the advisory (Markdown source, shown as plain text).

A security vulnerability has been identified that allows admin users to access sensitive server environment variables and system properties through user-configurable URLs. Specifically, when configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.

References

External links from the advisory. They lead to third-party sites.