CVE-2023-1664: Medium severity redhat Build Of Quarkus vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5cc8-pgp5-7mpm. This link is maintained to preserve external references.
Original Advisory A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If this happens and the KCSPITRUSTSTOREFILEFILE variable is missing/misconfigured, any trustfile may be accepted with the logging information of "Cannot validate client certificate trust: Truststore not available". This may not impact availability as the attacker would have no access to the server, but consumer applications Integrity or Confidentiality may be impacted considering a possible access to them. Considering the environment is correctly set to use "Revalidate Client Certificate" this flaw is avoidable.
Other sources
A flaw was found in keycloak-core. This flaw considers the scenario when using X509 Client Certificate Authenticatior with the option "Revalidate Client Certificate". A user may be able to choose, if directly connect to keycloak (not passing via reverse proxy) a specific certificate. If there's a configuration error in KCSPITRUSTSTOREFILEFILE the authenticator allows even with the "Cannot validate client certificate trust: Truststore not available" message as there's no certificate to trust against.
— Red Hat
A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If this happens and the KCSPITRUSTSTOREFILEFILE variable is missing/misconfigured, any trustfile may be accepted with the logging information of "Cannot validate client certificate trust: Truststore not available". This may not impact availability, but consumer applications Integrity or Confidentiality. Considering the environment is correctly set, this flaw is avoidable by configuring the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:18.0.8-1.redhat_00001.1.el7 - Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:18.0.8-1.redhat_00001.1.el8 - Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:18.0.8-1.redhat_00001.1.el9 - Upgrade
Upgrade
redhat/keycloak-coreto a version that resolves this vulnerability.Fixed in 21.1.2 - Configuration
Ensure the environment uses the X509 Client Certificate Authenticator option "Revalidate Client Certificate" (the advisory states the flaw is avoidable when this is correctly set).
Keycloak X509 Client Certificate Authenticator Revalidate Client Certificate = enabled - Configuration
Ensure KC_SPI_TRUSTSTORE_FILE_FILE is correctly set; the advisory states that if it is missing/misconfigured, any trustfile may be accepted. After attempting to explore the vulnerability, verify logs are not reporting "Cannot validate client certificate trust: Truststore not available".
Keycloak KC_SPI_TRUSTSTORE_FILE_FILE = correctly set - Compensating control
Use/rely on a reverse proxy that validates the client certificate before requests reach Keycloak (the advisory states the flaw depends on non-default "Revalidate Client Certificate" being enabled and the reverse proxy not validating the certificate before Keycloak).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this Keycloak flaw?
The vulnerability ID of this Keycloak flaw is CVE-2023-1664.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by enabling the non-default configuration 'Revalidate Client Certificate' and bypassing the certificate validation process.
What versions of Keycloak are affected by this vulnerability?
Keycloak versions up to and including 21.1.1 are affected by this vulnerability.
What is the severity of CVE-2023-1664?
CVE-2023-1664 has a severity rating of 6.5 (Medium).
Where can I find more information about CVE-2023-1664?
You can find more information about CVE-2023-1664 on the NIST website and the Red Hat Bugzilla and Security Advisory.