Lucene search

K
githubGitHub Advisory DatabaseGHSA-9VM7-V8WJ-3FQW
HistoryJan 23, 2024 - 2:43 p.m.

keycloak-core: open redirect via "form_post.jwt" JARM response mode

2024-01-2314:43:50
CWE-601
GitHub Advisory Database
github.com
20
keycloak
core patch
open redirect
jarm response mode
form_post.jwt
cve-2023-6134
security patch
authorization codes
tokens

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

45.2%

An incomplete fix was found in Keycloak Core patch. An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode “form_post.jwt”. It is observed that changing the response_mode parameter in the original proof of concept from “form_post” to “form_post.jwt” can bypass the security patch implemented to address CVE-2023-6134.

Affected configurations

Vulners
Node
org.keycloak\keycloakMatchcore
CPENameOperatorVersion
org.keycloak:keycloak-corelt23.0.4

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

45.2%