CVE-2017-7474 keycloak-connect and keycloak-js improperly handle invalid tokens
Attackers can bypass authentication in the Keycloak Node.js adapter by exploiting improper handling of invalid tokens, gaining unauthorized access to restricted information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7474?
CVE-2017-7474 is a critical authentication bypass vulnerability in Red Hat, Inc. Keycloak Node.js adapter, published on 12 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
Weakness: CWE-253
Which versions are affected by CVE-2017-7474?
4 open source packages ship an affected version, including keycloak-connect and keycloak-js. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
keycloak-connect npm | From 2.5.0 | 3.1.0 |
keycloak-connect npm | From 2.5.0 | 3.1.0 |
keycloak-js npm | From 2.5.0 | 3.1.0 |
keycloak-js npm | From 2.5.0 | 3.1.0 |
Products include Keycloak Keycloak-Nodejs-Auth-Utils.
How do I fix CVE-2017-7474?
Upgrade keycloak-connect to 3.1.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-7474 being exploited?
There is no known exploitation of CVE-2017-7474 in the wild and no public exploit code.
Sources
Also known as GHSA-mw35-24gh-f82w.