~ / search / GHSA-m6q9-p373-g5q8

GHSA-m6q9-p373-g5q8

Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

Source: GitHub Advisory Database (reviewed) High CVE-2024-1249

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 22.0.10 22.0.10
Maven org.keycloak:keycloak-services >= 23.0.0, < 24.0.3 24.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages. #### Acknowledgements Special thanks to Adriano Márcio Monteiro from BRZTEC for reporting this issue and helping us improve our project.

References

External links from the advisory. They lead to third-party sites.