CVE-2023-6563 Keycloak: offline session token dos
An attacker can cause a denial of service by triggering excessive memory consumption in Keycloak when loading offline sessions in the admin UI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-6563?
CVE-2023-6563 is a high-severity denial of service vulnerability in Redhat Keycloak, published on 14 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
Weakness: CWE-770
Which versions are affected by CVE-2023-6563?
2 open source packages ship an affected version, including org.keycloak:keycloak-model-jpa. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-model-jpa Maven | All versions | 21.0.0 |
org.keycloak:keycloak-model-jpa Maven | All versions | 21.0.0 |
Products include Redhat Keycloak, Redhat Openshift Container Platform, Redhat Openshift Container Platform for Ibm Linuxone, Redhat Openshift Container Platform for Power, Redhat Single Sign-On.
How do I fix CVE-2023-6563?
Upgrade org.keycloak:keycloak-model-jpa to 21.0.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-6563 being exploited?
There is no known exploitation of CVE-2023-6563 in the wild and no public exploit code.
Other vulnerabilities in Redhat Keycloak
- CVE-2022-4361 Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
- CVE-2022-1245 Keycloak vulnerable to privilege escalation on Token Exchange feature
- CVE-2021-20195 keycloak Self Stored Cross-site Scripting vulnerability
- CVE-2019-14910 Keycloak Authentication Error
- CVE-2019-14909 Keycloak Authentication Error
Sources
Also known as GHSA-54f3-c6hg-865h.