CVE-2024-1132

Summary

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

Affected Software

VendorProductVersion RangeStatus
21.1.0 < 22.0.10affected
23.0.0 < 24.0.3affected
Red HatMigration Toolkit for Runtimes 1 on RHEL 81.2-23 < *unaffected
Red HatMigration Toolkit for Runtimes 1 on RHEL 81.2-15 < *unaffected
Red HatMigration Toolkit for Runtimes 1 on RHEL 81.2-16 < *unaffected
Red HatMigration Toolkit for Runtimes 1 on RHEL 81.2-14 < *unaffected
Red HatMTA-6.2-RHEL-96.2.3-2 < *unaffected
Red HatRed Hat build of Keycloak 2222.0.10-1 < *unaffected
Red HatRed Hat build of Keycloak 2222-13 < *unaffected
Red HatRed Hat build of Keycloak 2222-16 < *unaffected
Red HatRed Hat Single Sign-On 7.6 for RHEL 70:18.0.13-1.redhat_00001.1.el7sso < *unaffected
Red HatRed Hat Single Sign-On 7.6 for RHEL 80:18.0.13-1.redhat_00001.1.el8sso < *unaffected
Red HatRed Hat Single Sign-On 7.6 for RHEL 90:18.0.13-1.redhat_00001.1.el9sso < *unaffected
Red HatRHEL-8 based Middleware Containers7.6-46 < *unaffected

Weaknesses

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Workarounds

No current mitigation is available for this vulnerability.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

CVE Program Container

Additional References

References