Описание
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
Отчет
MODERATE impact: Keycloak is vulnerable to a blind Server-Side Request Forgery (SSRF) due to improper handling of HTTP redirects during client configuration. An attacker can exploit this remotely without authentication or user interaction by crafting a sector_identifier_uri that redirects to internal resources, potentially leading to information disclosure and internal network reconnaissance.
Меры по смягчению последствий
To mitigate this vulnerability, restrict the outbound network access of the Keycloak instance. Configure firewall rules to prevent the Keycloak server from initiating connections to internal network segments, especially to well-known cloud metadata service IP addresses such as 169.254.169.254. For example, on Red Hat Enterprise Linux, you can use firewalld to add a rich rule:
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" destination address="169.254.169.254" reject'
sudo firewall-cmd --reload
This may impact other services if they legitimately rely on accessing these internal IPs. Additionally, ensure that any configured sector_identifier_uri values are thoroughly validated to only point to trusted, external URLs that do not perform redirects to internal resources.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Build of Keycloak | rhbk/keycloak-operator-bundle | Fix deferred | ||
| Red Hat Build of Keycloak | rhbk/keycloak-rhel9 | Affected | ||
| Red Hat Build of Keycloak | rhbk/keycloak-rhel9-operator | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 8 | keycloak-services | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | keycloak-services | Fix deferred | ||
| Red Hat Single Sign-On 7 | keycloak-services | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.8 Medium
CVSS3
Связанные уязвимости
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
A flaw was identified in Keycloak, an identity and access management s ...
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
EPSS
5.8 Medium
CVSS3