CVE-2024-0560: Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions
A vulnerability was found in 3Scale when using with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the authtype is use3scaleoidcissuerendpoint, Token Introspection policy discovers the Token Introspection endpoint from the tokenintrospectionendpoint field, but the field was removed on RH-SSO 7.5. As the result, the policy doesn't inspect tokens; it determines that all tokens are valid.
Using an alternate authtype: authtype: clientid+clientsecret. Disabling the policy entirely might be a temporary solution if the alternate {{authtype is not feasible for some reason. The only purpose the token introspection endpoint serves is for sessions which are revoked in RH SSO before the standard TTL expires via the exp claim.
Other sources
A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the authtype is use3scaleoidcissuerendpoint, the Token Introspection policy discovers the Token Introspection endpoint from the tokenintrospectionendpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0560?
CVE-2024-0560 has been classified as a moderate severity vulnerability.
How do I fix CVE-2024-0560?
To fix CVE-2024-0560, you should upgrade to the latest versions of Red Hat 3scale or Keycloak as recommended by the vendor.
What systems are affected by CVE-2024-0560?
CVE-2024-0560 affects Red Hat 3scale and Keycloak 15.0.0 as well as Red Hat Single Sign-On version 7.5.0 and above.
What type of vulnerability is CVE-2024-0560?
CVE-2024-0560 is an information disclosure vulnerability related to token introspection endpoint handling.
Is there a workaround for CVE-2024-0560?
Currently, the best course of action for CVE-2024-0560 is to implement the recommended upgrades, as no specific workarounds have been provided.