CVE-2022-3782: Keycloak vulnerable to path traversal via double URL encoding
Summary
CVE-2022-3782: Keycloak vulnerable to path traversal via double URL encoding. Affects org.keycloak:keycloak-parent versions < 20.0.2. Fixed in 20.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications. It is widely used to secure web applications and APIs. Keycloak allows users to authenticate via various protocols such as OpenID Connect, SAML, and OAuth. The vulnerability identified as CVE-2022-3782 affects Keycloak versions up to 20.0.0. It allows an attacker to bypass URL validation and perform path traversal attacks by exploiting double URL encoding. This can lead to unauthorized access to sensitive information within the domain and potential further attacks.
Vulnerability Detail
The vulnerability in Keycloak arises from inadequate URL validation during redirects. By crafting a malicious request with double URL encoding, an attacker can bypass the validation mechanism and access URLs that should be restricted. This can result in unauthorized access to sensitive information or enable the attacker to launch additional attacks. The vulnerability has a CVSS score of 9.1, indicating its critical severity.
How To Fix
Minimum fixed version
20.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is possible to implement additional URL validation checks within the application code. This can involve validating the requested URL against a whitelist of allowed URLs or implementing stricter input validation to detect and reject URLs with double URL encoding. However, applying the official fix by upgrading to the latest version is the recommended solution.
Conclusion
The vulnerability in Keycloak allows for path traversal attacks through double URL encoding, potentially leading to unauthorized access and further exploitation. It is crucial to upgrade to Keycloak version 20.0.2 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-parent →
FAQ
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications.
The vulnerability allows an attacker to bypass URL validation and perform path traversal attacks, potentially leading to unauthorized access to sensitive information within the domain and further exploitation.
Keycloak versions up to 20.0.0 are affected by this vulnerability.
The CVSS score of this vulnerability is 9.1, indicating its critical severity.
To fix this vulnerability, it is recommended to upgrade to Keycloak version 20.0.2 or later, which includes the necessary security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-parent.
