CVE-2019-3875: Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak
Summary
CVE-2019-3875: Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak. Affects org.keycloak:keycloak-core versions < 6.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure their applications and services. It provides features such as single sign-on, social login, and user federation. Keycloak uses X.509 certificates for client authentication, and the X.509 authenticator is responsible for verifying these certificates. The authenticator supports the use of Certificate Revocation Lists (CRL) to check the validity of client certificates. However, Keycloak does not validate the signatures on the CRL, which can lead to various attacks like man-in-the-middle.
Vulnerability Detail
The vulnerability in Keycloak (before version 6.0.2) arises from the lack of signature validation on Certificate Revocation Lists (CRL). This allows an attacker to potentially intercept and modify the CRL, leading to the acceptance of revoked or compromised client certificates. The CRL can be obtained from the URL provided in the certificate itself or through a separately configured path. Since CRLs are often available over unsecured protocols like HTTP or LDAP, the lack of signature validation poses a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to manually validate the signatures on the CRLs before using them. This can be done by retrieving the CRLs over a secure protocol (such as HTTPS) and verifying their signatures using a trusted certificate authority. Implementing this workaround will provide an additional layer of security until the upgrade can be performed.
Conclusion
The vulnerability in Keycloak (CVE-2019-3875) allows for improper certificate validation and insufficient verification of data authenticity. Upgrading to Keycloak version 6.0.2 or later is the recommended solution to fix this vulnerability. In the meantime, manually validating the signatures on CRLs can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that helps organizations secure their applications and services.
The X.509 authenticator in Keycloak is responsible for verifying client certificates used for authentication.
A Certificate Revocation List (CRL) is a list of digital certificates that have been revoked by the issuing certificate authority before their expiration date.
This vulnerability can potentially allow man-in-the-middle attacks, where an attacker intercepts and modifies the CRL, leading to the acceptance of revoked or compromised client certificates.
To mitigate the risk, it is recommended to upgrade to Keycloak version 6.0.2 or later, which includes the necessary changes to validate the signatures on CRLs.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
