CVE-2024-10492 Keycloak-quarkus-server: keycloak path trasversal
High-privilege users can read sensitive Vault files outside the expected context via path traversal in Keycloak.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-10492?
CVE-2024-10492 is a low-severity path traversal vulnerability in Red Hat JBoss Enterprise Application Platform 8, published on 25 Nov 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
Weakness: CWE-73
Which versions are affected by CVE-2024-10492?
4 open source packages ship an affected version, including org.keycloak:keycloak-quarkus-server.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-quarkus-server Maven | All versions | 26.0.6 |
org.keycloak:keycloak-quarkus-server Maven | All versions | 26.0.6 |
org.keycloak:keycloak-quarkus-server Maven | From 25.0.0 | 26.0.6 |
org.keycloak:keycloak-quarkus-server Maven | From 25.0.0 | 26.0.6 |
How do I fix CVE-2024-10492?
Upgrade org.keycloak:keycloak-quarkus-server to 26.0.6 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-10492 being exploited?
There is no known exploitation of CVE-2024-10492 in the wild and no public exploit code.
Sources
Also known as ECHO-7e4d-4229-7370, GHSA-5545-r4hg-rj4m.