CVE-2024-7341: Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5rxp-2rhr-qwqv. This link is maintained to preserve external references.
Original Description A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
Other sources
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
— GitHub
The SAML adapter is expected to change the sesion ID (and the respective JSESSIONID cookie) when the login is performed (except if the option turnOffChangeSessionIdOnLogin is true). This way the session ID is modified in the login to change the previous non-authenticated ID to a new one and avoid using the same valiue (just to protect against a possible cookie hijacking).
Requirements to exploit: You need to hijack the current session before authentication and it will be valid after it. Session fixation issue.
Component affected: org.keycloak.services
Version affected: <= 25.0.2 (also present in RHBK and RHSSO elytron variant).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 25.0.5 - Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 24.0.7 - Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 22.0.12 - Compensating control
Prevent session fixation by ensuring the SAML adapter changes the session ID (and the JSESSIONID cookie) at login time; do not enable the behavior that turns it off (i.e., avoid having turnOffChangeSessionIdOnLogin set to true).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7341?
CVE-2024-7341 is classified as a moderate severity vulnerability due to its potential impact on session management.
How do I fix CVE-2024-7341?
To fix CVE-2024-7341, upgrade Keycloak to version 25.0.5, 24.0.7, or 22.0.12 depending on your current version.
Which versions of Keycloak are affected by CVE-2024-7341?
CVE-2024-7341 affects Keycloak versions 23.0.0 to 25.0.2 and 22.0.0 to 22.0.11.
What type of issue is described in CVE-2024-7341?
CVE-2024-7341 describes a session fixation vulnerability in the SAML adapters provided by Keycloak.
Is there a known exploit for CVE-2024-7341?
As of now, there are no publicly disclosed exploits for CVE-2024-7341, but it is recommended to apply the necessary patches to mitigate risks.