REDHAT-BUG-2302064: Medium severity Keycloak services vulnerability
The SAML adapter is expected to change the sesion ID (and the respective JSESSIONID cookie) when the login is performed (except if the option turnOffChangeSessionIdOnLogin is true). This way the session ID is modified in the login to change the previous non-authenticated ID to a new one and avoid using the same valiue (just to protect against a possible cookie hijacking).
Requirements to exploit: You need to hijack the current session before authentication and it will be valid after it. Session fixation issue.
Component affected: org.keycloak.services
Version affected: <= 25.0.2 (also present in RHBK and RHSSO elytron variant).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the SAML adapter is configured to change the session ID (and JSESSIONID cookie) on login; do not set turnOffChangeSessionIdOnLogin to true. The expected behavior is to modify the previous non-authenticated session ID to a new one during authentication.
org.keycloak.services (SAML adapter) turnOffChangeSessionIdOnLogin = false
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2302064?
REDHAT-BUG-2302064 has a critical severity due to potential session fixation vulnerabilities.
How do I fix REDHAT-BUG-2302064?
To fix REDHAT-BUG-2302064, ensure that the option turnOffChangeSessionIdOnLogin is set to false.
Which software is affected by REDHAT-BUG-2302064?
Keycloak services version up to and including 25.0.2 are affected by REDHAT-BUG-2302064.
What is the main issue described in REDHAT-BUG-2302064?
The main issue in REDHAT-BUG-2302064 is that the session ID and JSESSIONID cookie are not changed during login, exposing a session fixation risk.
Is there a workaround for REDHAT-BUG-2302064?
Yes, you can disable the session ID change feature by setting the option turnOffChangeSessionIdOnLogin to true as a temporary workaround.