CVE-2024-8883: Keycloak: vulnerable redirect uri validation results in open redirec
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w8gr-xwp4-r9f7. This link is maintained to preserve external references.
Original Description A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Other sources
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
— GitHub
It is possible to configure Keycloak in such a manner that any application with a 'Valid Redirect URI' set to http://localhost or http://127.0.0.1 can be redirected to an arbitrary URL of the attackers choosing. In the process sensitive information such as the authorization code can be exposed to the attacker, resulting in possible session hijacking.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 25.0.6 - Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 24.0.8 - Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 22.0.13 - Compensating control
Ensure Keycloak 'Valid Redirect URI' entries do not include http://localhost and/or http://127.0.0.1 (including variants with a trailing slash), so an attacker cannot redirect users to an arbitrary URL and expose authorization codes for potential session hijacking.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8883?
CVE-2024-8883 has not been assigned a specific severity level due to its withdrawal as a duplicate.
How do I fix CVE-2024-8883?
To remediate CVE-2024-8883, upgrade the affected Keycloak services to version 25.0.6, 24.0.8, or 22.0.13 as appropriate.
What versions of Keycloak are affected by CVE-2024-8883?
CVE-2024-8883 affects Keycloak versions from 23.0.0 to 25.0.5 and from 22.0.0 to 22.0.12.
Is there a workaround for CVE-2024-8883?
There are no officially stated workarounds for CVE-2024-8883; updating to a fixed version is recommended.
What should organizations do regarding CVE-2024-8883?
Organizations should verify their Keycloak installation and ensure they are running the recommended patched versions to mitigate any potential risks.