Описание
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
A flaw was found in Keycloak. The use of an open hard-coded domain can allow an unauthorized login by setting up a mail server and resetting the user credentials, enabling information disclosure.
Меры по смягчению последствий
It is not a very straight forward workaround but it is possible to mitigate this by manually editing the default Email ID (service_account_name@placeholder.org) to some valid email ID (abc@gmail.com) in the USER_ENTITY table in the RHSSO database used.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | keycloak | Not affected | ||
| Red Hat Mobile Application Platform 4 | keycloak | Not affected | ||
| Red Hat OpenShift Application Runtimes | keycloak | Not affected | ||
| Red Hat Single Sign-On 7.3 | Fixed | RHSA-2019:4045 | 02.12.2019 | |
| Red Hat Single Sign-On 7.3 for RHEL 6 | rh-sso7-keycloak | Fixed | RHSA-2019:4040 | 02.12.2019 |
| Red Hat Single Sign-On 7.3 for RHEL 7 | rh-sso7-keycloak | Fixed | RHSA-2019:4041 | 02.12.2019 |
| Red Hat Single Sign-On 7.3 for RHEL 8 | rh-sso7-keycloak | Fixed | RHSA-2019:4042 | 02.12.2019 |
Показывать по
Дополнительная информация
Статус:
EPSS
9.1 Critical
CVSS3
Связанные уязвимости
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
A flaw was found in keycloack before version 8.0.0. The owner of 'plac ...
keycloak vulnerable to unauthorized login via mail server setup
Уязвимость программного средства для управления идентификацией и доступом Keycloak, связанная с использованием предустановленных регистрационных данных, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
9.1 Critical
CVSS3