CVE-2024-4540 Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-4540?
CVE-2024-4540 is a high-severity vulnerability in Red Hat RHEL-8 based Middleware Containers, published on 3 Jun 2024.
Official description
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.
Weakness: CWE-312
Which versions are affected by CVE-2024-4540?
2 open source packages ship an affected version, including org.keycloak:keycloak-services.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-services Maven | All versions | 24.0.5 |
org.keycloak:keycloak-services Maven | All versions | 24.0.5 |
Linux distribution packages (6)
rh-sso7-keycloak Red Hat:red_hat_single_sign_on:7.6::el7 | All versions | 0:18.0.14-1.redhat_00001.1.el7sso |
rh-sso7-keycloak-server Red Hat:red_hat_single_sign_on:7.6::el7 | All versions | 0:18.0.14-1.redhat_00001.1.el7sso |
rh-sso7-keycloak Red Hat:red_hat_single_sign_on:7.6::el8 | All versions | 0:18.0.14-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-server Red Hat:red_hat_single_sign_on:7.6::el8 | All versions | 0:18.0.14-1.redhat_00001.1.el8sso |
rh-sso7-keycloak Red Hat:red_hat_single_sign_on:7.6::el9 | All versions | 0:18.0.14-1.redhat_00001.1.el9sso |
rh-sso7-keycloak-server Red Hat:red_hat_single_sign_on:7.6::el9 | All versions | 0:18.0.14-1.redhat_00001.1.el9sso |
How do I fix CVE-2024-4540?
Upgrade org.keycloak:keycloak-services to 24.0.5 or later.
Is CVE-2024-4540 being exploited?
There is no known exploitation of CVE-2024-4540 in the wild and no public exploit code.
Sources
Also known as GHSA-69fp-7c8p-crjr, RHSA-2024:3566, RHSA-2024:3567, RHSA-2024:3568.