CVE-2024-7318: Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xmmm-jw76-q7vg. This link is maintained to preserve external references.
Original Description A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.
Other sources
Expired OTP codes are still usable when using FreeOTP when OTP token period is set to 30 seconds (default). It was found that instead of expiring and being unusable around 30 seconds in, the tokens actually are valid for an additional 30 seconds, to total 1 minute. In this case, this occurs with default OTP Policy settings of: OTP Type: Time-based OTP Hash Algorithm: SHA1 Number of digits: 6 Look around window: 1 OTP Token period: 30 seconds Reusable Token: off
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-coreto a version that resolves this vulnerability.Fixed in 25.0.4 - Upgrade
Upgrade
maven/org.keycloak:keycloak-coreto a version that resolves this vulnerability.Fixed in 24.0.7
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7318?
CVE-2024-7318 has a moderate severity rating due to the ability of expired OTP codes to still be usable.
How do I fix CVE-2024-7318?
To fix CVE-2024-7318, update Keycloak to version 25.0.4 or 24.0.7.
What versions of Keycloak are affected by CVE-2024-7318?
CVE-2024-7318 affects Keycloak versions between 22.0 and 24.0.7, excluding 25.0.4.
Is CVE-2024-7318 a duplicate advisory?
Yes, CVE-2024-7318 is a duplicate of GHSA-xmmm-jw76-q7vg.
What types of OTP codes are impacted by CVE-2024-7318?
CVE-2024-7318 impacts expired OTP codes used with FreeOTP in Keycloak.