CVE-2022-2237 keycloak-connect contains Open redirect vulnerability in the Node.js adapter
An attacker can exploit an open redirect in the Keycloak Node.js Adapter's checkSso function to redirect users to malicious sites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-2237?
CVE-2022-2237 is a medium-severity vulnerability in Redhat Single Sign-On, published on 27 Mar 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.
Weakness: CWE-601
Which versions are affected by CVE-2022-2237?
2 open source packages ship an affected version, including keycloak-connect. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
keycloak-connect npm | All versions | 21.0.1 |
keycloak-connect npm | All versions | 21.0.1 |
Products include Redhat Keycloak Node.js Adapter, Redhat Single Sign-On.
How do I fix CVE-2022-2237?
Upgrade keycloak-connect to 21.0.1 or later.
Is CVE-2022-2237 being exploited?
There is no known exploitation of CVE-2022-2237 in the wild and no public exploit code.
Sources
Also known as GHSA-59fq-727j-hm3f.