REDHAT-BUG-2429869: Input Validation
Improper input validation vulnerability in Keycloak related to the handling of matrix parameters in URL paths. The issue occurs because Keycloak, via its JAX-RS routing layer, accepts RFC-compliant matrix parameters (e.g., ;param) in path segments, while common reverse proxy configurations may ignore or mishandle them when enforcing access restrictions. A remote attacker can craft requests such as /realms;abc/master/account to mask path segments and bypass proxy-level path filtering. Although authentication is still required, this may expose administrative or sensitive endpoints that operators believe are not externally reachable. Exploitation is network-based, requires no authentication, and depends on the reverse proxy configuration in front of Keycloak.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the reverse proxy (fronting Keycloak) path filtering/access-restriction rules to properly handle RFC-compliant matrix parameters in URL path segments (e.g., segments containing ";param") so crafted paths like "/realms;abc/master/account" cannot mask path segments and bypass proxy-level filtering.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2429869?
The severity of REDHAT-BUG-2429869 is considered high due to potential exploitation via improper input validation.
How do I fix REDHAT-BUG-2429869?
To fix REDHAT-BUG-2429869, ensure you apply the latest security patch provided by Red Hat for Keycloak.
What impact does REDHAT-BUG-2429869 have on my system?
The impact of REDHAT-BUG-2429869 could allow an attacker to manipulate URL parameters and potentially bypass security mechanisms.
Which versions of Keycloak are affected by REDHAT-BUG-2429869?
REDHAT-BUG-2429869 affects all currently supported versions of Red Hat Keycloak that do not have the appropriate patch.
Is there a workaround for REDHAT-BUG-2429869?
A possible workaround for REDHAT-BUG-2429869 is to reconfigure the reverse proxy to correctly handle matrix parameters.