Open redirect in Keycloak - CVE-2023-6927

Vulnerability identifier: #VU85171

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-6927

CWE-ID: CWE-601

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt".

Keycloak
Red Hat Single Sign-On
rh-sso7-keycloak (Red Hat package)

Install updates from vendor's website.

Keycloak - addressed in versions 22.0.8, 23.0.4
Red Hat Single Sign-On - addressed in versions 7.6.6, 7.6.7
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.11-3.redhat_00001.1.el7sso, 18.0.11-3.redhat_00001.1.el8sso, 18.0.11-3.redhat_00001.1.el9sso, 18.0.12-1.redhat_00001.1.el7sso, 18.0.12-1.redhat_00001.1.el8sso, 18.0.12-1.redhat_00001.1.el9sso

• https://access.redhat.com/security/cve/CVE-2023-6927
• https://bugzilla.redhat.com/show_bug.cgi?id=2255027
• https://access.redhat.com/errata/RHSA-2024:0100
• https://access.redhat.com/errata/RHSA-2024:0101
• https://github.com/keycloak/keycloak/security/advisories/GHSA-9vm7-v8wj-3fqw

• Open redirect in Keycloak
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 8