Insufficient Session Expiration in Keycloak - CVE-2022-3916
Published: December 13, 2022
Vulnerability identifier: #VU70166
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-3916
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to reuse of session ids across root and user authentication sessions when using a client with the offline_access scope. An attacker with ability to obtain the root session ID can utilize the refresh token and authenticate to the application as another user.
The issue affects shared environments, where the attacker is able to obtain victim's cookies after the victim logs out.
Affected software
Keycloak
Red Hat Single Sign-On
rh-sso7-keycloak (Red Hat package)
Red Hat Single Sign-On
rh-sso7-keycloak (Red Hat package)
How to mitigate CVE-2022-3916
Install updates from vendor's website.
Keycloak - update to 19.0.3
Red Hat Single Sign-On - addressed in versions 7.6.1, 7.6.2
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.3-1.redhat_00002.1.el7sso, 18.0.3-1.redhat_00002.1.el8sso, 18.0.3-1.redhat_00002.1.el9sso, 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso
Red Hat Single Sign-On - addressed in versions 7.6.1, 7.6.2
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.3-1.redhat_00002.1.el7sso, 18.0.3-1.redhat_00002.1.el8sso, 18.0.3-1.redhat_00002.1.el9sso, 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso
External References
Related Security Bulletins
- Session takeover in keycloak
- Red Hat Single Sign-On 7.6 update for keycloak
- Red Hat Single Sign-On 7.6 for RHEL 8 update for keycloak
- Red Hat Single Sign-On 7.6 for RHEL 9 update for keycloak
- Red Hat Single Sign-On 7.6 for RHEL 7 update for keycloak
- Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
- Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
- Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
- Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
- Multiple vulnerabilities in Red Hat Single Sign-On 7.6