Описание
A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.
Ссылки
- Issue TrackingVendor Advisory
- Issue TrackingPermissions RequiredThird Party Advisory
- Issue TrackingVendor Advisory
- Issue TrackingPermissions RequiredThird Party Advisory
Уязвимые конфигурации
EPSS
7.3 High
CVSS3
7.5 High
CVSS2
Дефекты
Связанные уязвимости
A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.
A vulnerability was found in all versions of Keycloak Gatekeeper, wher ...
Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers
EPSS
7.3 High
CVSS3
7.5 High
CVSS2