CVE-2022-1438: Keycloak: xss on impersonation under specific circumstances

Reference Links

• https://github.com/keycloak/keycloak/security/advisories/GHSA-w354-2f3c-qvg9
• https://access.redhat.com/security/cve/cve-2022-1438
• https://bugzilla.redhat.com/show_bug.cgi?id=2031904
• https://github.com/keycloak/keycloak/blob/48835576daa158443f69917ac309e1a7c951bc87/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java#L1045
• https://nvd.nist.gov/vuln/detail/CVE-2022-1438
• https://access.redhat.com/errata/RHSA-2023:1043
• https://access.redhat.com/errata/RHSA-2023:1044
• https://access.redhat.com/errata/RHSA-2023:1045
• https://access.redhat.com/errata/RHSA-2023:1047
• https://access.redhat.com/errata/RHSA-2023:1049
• https://github.com/advisories/GHSA-w354-2f3c-qvg9 (Advisory)
• https://access.redhat.com/security/cve/CVE-2022-1438
• https://www.cve.org/CVERecord?id=CVE-2022-1438 https://nvd.nist.gov/vuln/detail/CVE-2022-1438

Parent vulnerabilities

(Appears in the following advisories)

• RHSA-2023:1049
• RHSA-2023:1043
• RHSA-2023:1044
• RHSA-2023:1045
• RHSA-2023:1047

Frequently Asked Questions

• What is the vulnerability ID?

  The vulnerability ID is CVE-2022-1438.

• What is the severity of CVE-2022-1438?

  The severity of CVE-2022-1438 is medium (6.4).

• How does CVE-2022-1438 occur?

  CVE-2022-1438 occurs when HTML entities are not sanitized during user impersonation in Keycloak, resulting in a Cross-site scripting (XSS) vulnerability.

• What software is affected by CVE-2022-1438?

  The following software versions are affected by CVE-2022-1438: - keycloak-services version 21.0.0 - rh-sso7-keycloak versions up to 0:18.0.6-1.redhat_00001.1.el7, 0:18.0.6-1.redhat_00001.1.el8, and 0:18.0.6-1.redhat_00001.1.el9 - Redhat Keycloak

• How can CVE-2022-1438 be fixed?

  CVE-2022-1438 can be fixed by upgrading Keycloak to a version that includes the necessary fixes. Refer to the provided references for more details.