Open redirect in Keycloak - CVE-2024-8883

Vulnerability identifier: #VU97622

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-8883

CWE-ID: CWE-601

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to a misconfiguration when handling redirects. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

Keycloak
Red Hat Single Sign-On
JBoss Enterprise Application Platform
Dell Data Protection Central
eap8-asyncutil (Red Hat package)
eap8-hppc (Red Hat package)
eap8-jboss-cert-helper (Red Hat package)
eap8-insights-java-client (Red Hat package)
eap8-cryptacular (Red Hat package)
eap8-aesh-extensions (Red Hat package)
eap8-aws-java-sdk (Red Hat package)
eap8-apache-commons-codec (Red Hat package)
eap8-activemq-artemis-native (Red Hat package)
eap8-artemis-native (Red Hat package)
eap8-artemis-wildfly-integration (Red Hat package)
eap8-resteasy-extensions (Red Hat package)
eap8-slf4j (Red Hat package)
eap8-fastinfoset (Red Hat package)
eap8-snakeyaml (Red Hat package)
eap8-aesh-readline (Red Hat package)
eap8-pem-keystore (Red Hat package)
eap8-apache-commons-io (Red Hat package)
eap8-log4j (Red Hat package)
eap8-activemq-artemis (Red Hat package)
eap8-jakarta-servlet-jsp-jstl-api (Red Hat package)
eap8-resteasy-spring (Red Hat package)
eap8-saaj-impl (Red Hat package)
eap8-apache-commons-collections (Red Hat package)
eap8-jboss-logging (Red Hat package)
eap8-apache-commons-lang (Red Hat package)
eap8-jctools (Red Hat package)
eap8-apache-cxf (Red Hat package)
eap8-jgroups (Red Hat package)
eap8-narayana (Red Hat package)
eap8-hibernate (Red Hat package)
eap8-shibboleth-java-support (Red Hat package)
eap8-hibernate-validator (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-objectweb-asm (Red Hat package)
eap8-nimbus-jose-jwt (Red Hat package)
rh-sso7-keycloak (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)
Red Hat build of Keycloak

Install updates from vendor's website.

Keycloak - addressed in versions 22.0.13, 24.0.8, 25.0.6
Red Hat Single Sign-On - update to 7.6.11
JBoss Enterprise Application Platform - addressed in versions 8.0.4, 8.0.4.1
Dell Data Protection Central - update to 19.12.0-2
eap8-asyncutil (Red Hat package) - addressed in versions 0.1.0-2.redhat_00010.1.el8eap, 0.1.0-2.redhat_00010.1.el9eap
eap8-hppc (Red Hat package) - addressed in versions 0.8.1-2.redhat_00001.1.el8eap, 0.8.1-2.redhat_00001.1.el9eap
eap8-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap8-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap8-cryptacular (Red Hat package) - addressed in versions 1.2.5-2.redhat_00001.1.el8eap, 1.2.5-2.redhat_00001.1.el9eap
eap8-aesh-extensions (Red Hat package) - addressed in versions 1.8.0-2.redhat_00001.1.el8eap, 1.8.0-2.redhat_00001.1.el9eap
eap8-aws-java-sdk (Red Hat package) - addressed in versions 1.12.284-2.redhat_00002.1.el8eap, 1.12.284-2.redhat_00002.1.el9eap
eap8-apache-commons-codec (Red Hat package) - addressed in versions 1.16.1-2.redhat_00007.1.el8eap, 1.16.1-2.redhat_00007.1.el9eap
eap8-activemq-artemis-native (Red Hat package) - addressed in versions 2.0.0-2.redhat_00005.1.el8eap, 2.0.0-2.redhat_00005.1.el9eap
eap8-artemis-native (Red Hat package) - addressed in versions 2.0.0-2.redhat_00005.1.el8eap, 2.0.0-2.redhat_00005.1.el9eap
eap8-artemis-wildfly-integration (Red Hat package) - addressed in versions 2.0.1-1.redhat_00002.1.el8eap, 2.0.1-1.redhat_00002.1.el9eap
eap8-resteasy-extensions (Red Hat package) - addressed in versions 2.0.1-3.Final_redhat_00001.1.el8eap, 2.0.1-3.Final_redhat_00001.1.el9eap
eap8-slf4j (Red Hat package) - addressed in versions 2.0.16-1.redhat_00001.1.el8eap, 2.0.16-1.redhat_00001.1.el9eap
eap8-fastinfoset (Red Hat package) - addressed in versions 2.1.0-4.redhat_00001.1.el8eap, 2.1.0-4.redhat_00001.1.el9eap
eap8-snakeyaml (Red Hat package) - addressed in versions 2.2.0-1.redhat_00001.1.el8eap, 2.2.0-1.redhat_00001.1.el9eap
eap8-aesh-readline (Red Hat package) - addressed in versions 2.2.0-2.redhat_00001.1.el8eap, 2.2.0-2.redhat_00001.1.el9eap
eap8-pem-keystore (Red Hat package) - addressed in versions 2.3.0-1.redhat_00001.1.el8eap, 2.3.0-1.redhat_00001.1.el9eap
eap8-apache-commons-io (Red Hat package) - addressed in versions 2.15.1-1.redhat_00001.1.el8eap, 2.15.1-1.redhat_00001.1.el9eap
eap8-log4j (Red Hat package) - addressed in versions 2.22.1-1.redhat_00002.1.el8eap, 2.22.1-1.redhat_00002.1.el9eap
eap8-activemq-artemis (Red Hat package) - addressed in versions 2.33.0-1.redhat_00015.1.el8eap, 2.33.0-1.redhat_00015.1.el9eap
eap8-jakarta-servlet-jsp-jstl-api (Red Hat package) - addressed in versions 3.0.1-1.redhat_00001.1.el8eap, 3.0.1-1.redhat_00001.1.el9eap
eap8-resteasy-spring (Red Hat package) - addressed in versions 3.0.1-2.Final_redhat_00001.1.el8eap, 3.0.1-2.Final_redhat_00001.1.el9eap
eap8-saaj-impl (Red Hat package) - addressed in versions 3.0.4-1.redhat_00001.1.el8eap, 3.0.4-1.redhat_00001.1.el9eap
eap8-apache-commons-collections (Red Hat package) - addressed in versions 3.2.2-28.redhat_2.1.el8eap, 3.2.2-28.redhat_2.1.el9eap
eap8-jboss-logging (Red Hat package) - addressed in versions 3.5.3-1.Final_redhat_00001.1.el8eap, 3.5.3-1.Final_redhat_00001.1.el9eap
eap8-apache-commons-lang (Red Hat package) - addressed in versions 3.14.0-2.redhat_00006.1.el8eap, 3.14.0-2.redhat_00006.1.el9eap
eap8-jctools (Red Hat package) - addressed in versions 4.0.2-1.redhat_00001.1.el8eap, 4.0.2-1.redhat_00001.1.el9eap
eap8-apache-cxf (Red Hat package) - addressed in versions 4.0.5-1.redhat_00001.1.el8eap, 4.0.5-1.redhat_00001.1.el9eap
eap8-jgroups (Red Hat package) - addressed in versions 5.3.10-1.Final_redhat_00001.1.el8eap, 5.3.10-1.Final_redhat_00001.1.el9eap
eap8-narayana (Red Hat package) - addressed in versions 6.0.3-1.Final_redhat_00001.1.el8eap, 6.0.3-1.Final_redhat_00001.1.el9eap
eap8-hibernate (Red Hat package) - addressed in versions 6.2.31-1.Final_redhat_00002.1.el8eap, 6.2.31-1.Final_redhat_00002.1.el9eap
eap8-shibboleth-java-support (Red Hat package) - addressed in versions 8.0.0-6.redhat_00001.1.el8eap, 8.0.0-6.redhat_00001.1.el9eap
eap8-hibernate-validator (Red Hat package) - addressed in versions 8.0.1-3.Final_redhat_00001.1.el8eap, 8.0.1-3.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.4-2.GA_redhat_00005.1.el8eap, 8.0.4-2.GA_redhat_00005.1.el9eap, 8.0.4-3.GA_redhat_00007.1.el8eap, 8.0.4-3.GA_redhat_00007.1.el9eap
eap8-objectweb-asm (Red Hat package) - addressed in versions 9.6.0-1.redhat_00002.1.el8eap, 9.6.0-1.redhat_00002.1.el9eap
eap8-nimbus-jose-jwt (Red Hat package) - addressed in versions 9.37.3-1.redhat_00001.1.el8eap, 9.37.3-1.redhat_00001.1.el9eap
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.18-1.redhat_00001.1.el7sso, 18.0.18-1.redhat_00001.1.el8sso, 18.0.18-1.redhat_00001.1.el9sso
Red Hat build of Keycloak - addressed in versions 22.0.13, 24.0.8
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.4.0-1.GA_redhat_00001.1.el8eap, 800.4.0-1.GA_redhat_00001.1.el9eap, 800.4.1-1.GA_redhat_00001.1.el8eap, 800.4.1-1.GA_redhat_00001.1.el9eap

• https://bugzilla.redhat.com/show_bug.cgi?id=2312511
• https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java
• https://github.com/advisories/GHSA-vvf8-2h68-9475
• https://github.com/keycloak/keycloak/releases/tag/25.0.6
• https://github.com/keycloak/keycloak/security/advisories/GHSA-w8gr-xwp4-r9f7

• Multiple vulnerabilities in Keycloak
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat build of Keycloak 22.0
• Multiple vulnerabilities in Red Hat build of Keycloak 22.0
• Multiple vulnerabilities in Red Hat build of Keycloak 24.0
• Multiple vulnerabilities in Red Hat build of Keycloak 24.0
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
• Open redirect in Red Hat JBoss Enterprise Application Platform 8.0
• Dell Data Protection Central update for third-party component