CVE-2022-1245 Keycloak vulnerable to privilege escalation on Token Exchange feature
A missing authorization flaw in Keycloak's token exchange allows clients to gain unauthorized access to additional services by specifying arbitrary target client IDs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1245?
CVE-2022-1245 is a critical missing authorization vulnerability in Redhat Keycloak, published on 7 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.
Which versions are affected by CVE-2022-1245?
2 open source packages ship an affected version, including org.keycloak:keycloak-services. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-services Maven | All versions | 18.0.0 |
org.keycloak:keycloak-services Maven | All versions | 18.0.0 |
Linux distribution packages (4)
rh-sso7-keycloak Red Hat:red_hat_single_sign_on:7.5::el7 | All versions | 0:15.0.6-1.redhat_00002.1.el7sso |
rh-sso7-keycloak-server Red Hat:red_hat_single_sign_on:7.5::el7 | All versions | 0:15.0.6-1.redhat_00002.1.el7sso |
rh-sso7-keycloak Red Hat:red_hat_single_sign_on:7.5::el8 | All versions | 0:15.0.6-1.redhat_00002.1.el8sso |
rh-sso7-keycloak-server Red Hat:red_hat_single_sign_on:7.5::el8 | All versions | 0:15.0.6-1.redhat_00002.1.el8sso |
Products include Redhat Keycloak.
How do I fix CVE-2022-1245?
Upgrade org.keycloak:keycloak-services to 18.0.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-1245 being exploited?
There is no known exploitation of CVE-2022-1245 in the wild and no public exploit code.
Other vulnerabilities in Redhat Keycloak
- CVE-2022-4361 Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
- CVE-2021-20195 keycloak Self Stored Cross-site Scripting vulnerability
- CVE-2019-14910 Keycloak Authentication Error
- CVE-2019-14909 Keycloak Authentication Error
- CVE-2022-3782 Keycloak vulnerable to path traversal via double URL encoding
Sources
Also known as GHSA-75p6-52g3-rqc8, RHSA-2022:1711, RHSA-2022:1712.