CVE-2019-3868: Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

Background

Keycloak is an open-source identity and access management solution that provides single sign-on capabilities for web applications. It allows users to authenticate once and gain access to multiple applications without the need for separate login credentials. Keycloak uses tokens, such as access or id tokens JWT, to manage user sessions and provide secure authentication. However, prior to version 6.0.0, Keycloak allowed the end user token to be used as the session cookie for browser sessions for OIDC. This introduced a vulnerability where an attacker with access to the service provider backend could hijack a user's browser session.

Vulnerability Detail

The vulnerability (CVE-2019-3868) in Keycloak allows an unauthorized actor to gain access to sensitive information. By exploiting this vulnerability, an attacker with access to the service provider backend can hijack a user's browser session. This means that the attacker can impersonate the user and perform actions on their behalf, potentially leading to unauthorized access to sensitive data or unauthorized actions within the application.

Workaround

If upgrading Keycloak is not immediately feasible, a possible workaround is to implement a custom session management solution that does not rely on the end user token as the session cookie. This can involve generating a separate session identifier and associating it with the user's token. By decoupling the session management from the token, the vulnerability can be mitigated. Here is an example of how this can be done in Java using the Keycloak Java Adapter:

// Generate a session identifier
String sessionId = generateSessionId();

// Associate the session identifier with the user's token
Token token = ...; // Retrieve the user's token
token.setSessionId(sessionId);

// Store the session identifier in a secure manner
storeSessionId(sessionId);

Conclusion

In conclusion, the vulnerability (CVE-2019-3868) in Keycloak allows an unauthorized actor to hijack a user's browser session, potentially leading to unauthorized access to sensitive data or unauthorized actions within the application. To mitigate this vulnerability, it is recommended to upgrade Keycloak to version 6.0.0 or later. If immediate upgrade is not possible, implementing a custom session management solution can serve as a temporary workaround. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for org.keycloak:keycloak-core →

FAQ