AIKIDO-2024-10367
keycloak-services is vulnerable to URL Redirection to Untrusted Site ('Open Redirect')
63
Medium Risk
This Affects:
keycloak-servicesTL;DR
Affected versions of the package are vulnerable to open redirect due to a misconfiguration in the validation of redirect URIs. An attacker can exploit this flaw by setting a valid redirect URI to http://localhost/ or http://127.0.0.1/, causing the application to redirect users to a malicious location.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
keycloak-services is vulnerable to URL Redirection to Untrusted Site ('Open Redirect') in versions 0.0.1 - 22.0.12, 24.0.0 - 24.0.7 and 25.0.0 - 25.0.5.
How to fix this
Upgrade the org.keycloak:keycloak-services library to a patch version.
Links
Related Issue
Other
access.redhat.com/errata/RHSA-2024:10175access.redhat.com/errata/RHSA-2024:10176access.redhat.com/errata/RHSA-2024:10177access.redhat.com/errata/RHSA-2024:10178access.redhat.com/security/cve/CVE-2024-10492bugzilla.redhat.com/show_bug.cgi?id=2322447
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant