Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
CVE-2024-4540

7.5HIGH

Key Information:

Vendor
Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Build Of Keycloak 22
Red Hat Build Of Keycloak 24
Red Hat Single Sign-on 7
Vendor
CVE Published:
3 June 2024

Summary

A vulnerability exists in Keycloak related to OAuth 2.0 Pushed Authorization Requests (PAR). This issue arises from client-provided parameters being transmitted in plain text within the KC_RESTART cookie included in the HTTP response of the authorization server during a request_uri authorization request. This situation could potentially lead to unauthorized information disclosure, allowing attackers to access sensitive data inadvertently exposed through these cookies. It's crucial for users and administrators to review their Keycloak implementations for configurations susceptible to this flaw.

References

https://access.redhat.com/errata/RHSA-2024:3566
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:3567
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:3568
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Collectors

NVD DatabaseMitre Database

Credit

Red Hat would like to thank Manuel Schallar for reporting this issue.
.