CVE-2017-7474: Vulnerability in keycloak-connect and keycloak-js
Summary
CVE-2017-7474: keycloak-connect and keycloak-js improperly handle invalid tokens. Affects keycloak-connect versions >= 2.5.0, < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution for modern applications and services. It provides features like single sign-on, social login, and user federation. keycloak-connect and keycloak-js are Node.js adapters for integrating Keycloak with Node.js applications. They allow developers to secure their applications using Keycloak's authentication and authorization capabilities.
Vulnerability Detail
The Keycloak Node.js adapter versions 2.5 to 3.0 were found to have a high severity vulnerability. These versions did not handle invalid tokens correctly, which could be exploited by an attacker. By exploiting this flaw, an attacker could bypass authentication and gain access to restricted information or potentially conduct further attacks.
How To Fix
Minimum fixed version
3.1.0
This is the first release that contains the fix.
npm install keycloak-connect@3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions to ensure the security of the application.
Conclusion
The Keycloak Node.js adapter versions 2.5 to 3.0 have a high severity vulnerability that allows for authentication bypass and unauthorized access. To mitigate this vulnerability, it is crucial to upgrade to version 3.1.0 or higher of keycloak-connect and keycloak-js. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keycloak-connect →
FAQ
Keycloak is an open-source identity and access management solution for modern applications and services. It provides features like single sign-on, social login, and user federation.
keycloak-connect and keycloak-js are Node.js adapters for integrating Keycloak with Node.js applications. They allow developers to secure their applications using Keycloak's authentication and authorization capabilities.
This vulnerability allows an attacker to bypass authentication and gain unauthorized access to restricted information. It can also potentially lead to further attacks on the application.
To fix this vulnerability, it is recommended to upgrade to version 3.1.0 or higher of keycloak-connect and keycloak-js.
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions to ensure the security of the application.
Related vulnerabilities
Recent vulnerabilities recorded for keycloak-connect.
