[MAVEN:GHSA-M6Q9-P373-G5Q8] Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

Severity High

Affected Packages 2

Fixed Packages 2

CVEs 1

A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

Acknowledgements

Special thanks to Adriano Márcio Monteiro from BRZTEC for reporting this issue and helping us improve our project.

Package	Affected Version
pkg:maven/org.keycloak/keycloak-services	>= 23.0.0, < 24.0.3
pkg:maven/org.keycloak/keycloak-services	< 22.0.10

Package	Fixed Version
pkg:maven/org.keycloak/keycloak-services	= 24.0.3
pkg:maven/org.keycloak/keycloak-services	= 22.0.10

ID: MAVEN:GHSA-M6Q9-P373-G5Q8
Severity: high
URL: https://github.com/advisories/GHSA-m6q9-p373-g5q8
Published: 2024-04-17T18:24:38
(5 months ago)
Modified: 2024-04-17T18:24:39
(5 months ago)
Rights: Maven Security Team

Source	# ID	Name	URL
			https://github.com/keycloak/keycloak/security/advisories/GHSA-m6q9-p373-g5q8
			https://nvd.nist.gov/vuln/detail/CVE-2024-1249
			https://access.redhat.com/errata/RHSA-2024:1868
			https://access.redhat.com/security/cve/CVE-2024-1249
			https://bugzilla.redhat.com/show_bug.cgi?id=2262918
			https://github.com/advisories/GHSA-m6q9-p373-g5q8

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.keycloak/keycloak-services	org.keycloak	keycloak-services	>= 23.0.0 < 24.0.3
Fixed	pkg:maven/org.keycloak/keycloak-services	org.keycloak	keycloak-services	= 24.0.3
Affected	pkg:maven/org.keycloak/keycloak-services	org.keycloak	keycloak-services	< 22.0.10
Fixed	pkg:maven/org.keycloak/keycloak-services	org.keycloak	keycloak-services	= 22.0.10

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date