CVE-2017-2582: Infoleak
It was found that Picketlink implementation replaces special strings for obtaining attribute values with system property values in SAML messages while parsing. An attacker can misuse this to determine values of system properties at the attacked system by formatting the SAML request ID field to the chosen system property name of his liking, obtaining the property value in "InResponseTo" field in the response.
Upstream bug (for Keycloak):
https://issues.jboss.org/browse/KEYCLOAK-4160
Other sources
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-coreto a version that resolves this vulnerability.Fixed in 2.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2582?
CVE-2017-2582 has a moderate severity rating due to potential information disclosure vulnerabilities.
How do I fix CVE-2017-2582?
To fix CVE-2017-2582, upgrade to keycloak-core version 2.5.1 or later.
Which software is affected by CVE-2017-2582?
CVE-2017-2582 affects Keycloak versions before 2.5.1 and specific versions of Red Hat JBoss Enterprise Application Platform.
What happens if I’m still running a vulnerable version related to CVE-2017-2582?
Running a vulnerable version of software related to CVE-2017-2582 could allow attackers to access sensitive system property values.
Is there a workaround for CVE-2017-2582?
There is no specific workaround for CVE-2017-2582; upgrading to an unaffected version is the recommended approach.