[MAVEN:GHSA-MPWQ-J3XF-7M5W] The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
Severity
High
Affected Packages
1
Fixed Packages
1
CVEs
1
An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.
The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "www%2ekeycloak%2eorg%2fapp%2f:y@example.com" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input.
Acknowledgements
Karel Knibbe
Package | Affected Version |
---|---|
pkg:maven/org.keycloak/keycloak-services | < 23.0.3 |
Package | Fixed Version |
---|---|
pkg:maven/org.keycloak/keycloak-services | = 23.0.3 |
- ID
- MAVEN:GHSA-MPWQ-J3XF-7M5W
- Severity
- high
- URL
- https://github.com/advisories/GHSA-mpwq-j3xf-7m5w
- Published
-
2023-12-21T18:25:30
(9 months ago) - Modified
-
2023-12-21T18:25:31
(9 months ago) - Rights
- Maven Security Team
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:maven/org.keycloak/keycloak-services | org.keycloak | keycloak-services | < 23.0.3 | |||
Fixed | pkg:maven/org.keycloak/keycloak-services | org.keycloak | keycloak-services | = 23.0.3 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |