REDHAT-BUG-2448543: SSRF
Server-Side Request Forgery (SSRF) vulnerability in Keycloak due to improper handling of HTTP redirects during client configuration processing. The flaw arises because Keycloak follows redirect responses (e.g., HTTP 302) without validating the final destination URL. An attacker can supply a crafted sectoridentifieruri that initially matches allowed patterns but redirects to internal resources such as cloud metadata endpoints (e.g., 169.254.169.254). This causes Keycloak to issue unintended requests from its network context, enabling blind SSRF. The vulnerability can be exploited remotely without authentication or user interaction, allowing attackers to perform internal network reconnaissance and potentially access sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable following HTTP redirects when Keycloak fetches sector_identifier_uri or other client configuration URLs so that Keycloak does not automatically follow 3xx responses to final destinations.
Keycloak (sector_identifier_uri/client configuration processing) follow_http_redirects_when_fetching_sector_identifier_uri = false - Configuration
After any redirect responses, validate the final destination URL and permit it only if it matches an explicit allowlist of trusted domains; explicitly disallow internal addresses and link-local IPs (for example 169.254.169.254).
Keycloak (sector_identifier_uri/client configuration processing) validate_final_redirect_destination = allowlist-only / block internal-addresses - Compensating control
Apply network-level controls to prevent Keycloak from reaching internal metadata endpoints and other sensitive internal resources. For example, block outbound requests from the Keycloak host to cloud metadata IPs (e.g., 169.254.169.254) and restrict Keycloak egress to trusted external endpoints via firewall/ACLs.
- Operational
Review recent Keycloak logs for requests initiated while processing sector_identifier_uri (including requests to internal addresses). If there is any indication that sensitive information may have been accessed, rotate affected credentials and secrets (for example cloud instance metadata credentials) and follow incident response procedures.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2448543?
The severity of REDHAT-BUG-2448543 is critical due to the potential for exploitation through Server-Side Request Forgery.
How do I fix REDHAT-BUG-2448543?
To fix REDHAT-BUG-2448543, ensure that you update to the latest patched version of Keycloak that addresses the SSRF vulnerability.
What impact does REDHAT-BUG-2448543 have on my system?
REDHAT-BUG-2448543 can allow an attacker to perform unauthorized actions on behalf of the server, potentially accessing internal resources.
What versions of Keycloak are affected by REDHAT-BUG-2448543?
All versions of Red Hat Keycloak prior to the patch release for REDHAT-BUG-2448543 are affected.
How can I mitigate the risks associated with REDHAT-BUG-2448543 until a fix is applied?
Until a fix is applied for REDHAT-BUG-2448543, consider disabling any features that rely on unsafe HTTP redirects in your Keycloak configuration.