CVE-2019-10157: Medium severity red hat keycloak vulnerability
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.
Other sources
It was found that Keycloak's Node.js adapter did not properly verify the web token received from the server in its backchannel logout. An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.
The admin backchannel logout route (/klogout) doesn't verify the signature of the JWT it receives from Keycloak. This causes to the adapter to update the grant manager with a NBF in the future. This effectively logs users out of the app and prevents them from logging in again. Since the tokens received from the code exchange will appear to be in the future, this could be used maliciously against applications using the adapter.
Upstream patch:
https://github.com/keycloak/keycloak-nodejs-connect/commit/55e54b55d05ba636bc125a8f3d39f0052d13f8f6
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10157?
CVE-2019-10157 is considered a medium severity vulnerability due to potential unauthorized access to user sessions.
How do I fix CVE-2019-10157?
To fix CVE-2019-10157, update the keycloak-nodejs-connect package to version 4.8.3 or later.
What systems are affected by CVE-2019-10157?
CVE-2019-10157 affects Keycloak's Node.js adapter versions prior to 4.8.3.
What exploit scenario is possible with CVE-2019-10157?
An attacker with local access could potentially craft a malicious web token to disrupt user access.
Is there a workaround for CVE-2019-10157?
There is no specific workaround for CVE-2019-10157; upgrading to the fixed version is recommended.