GHSA-97g8-xfvw-q4hg CVE-2022-3916
Keycloak vulnerable to session takeover with OIDC offline refreshtokens
- Severity
- 6.8 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.95%
- Chance of exploitation in the next 30 days. Higher than 61.33% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-287 Improper Authentication
- CWE-304 Missing Critical Step in Authentication
- CWE-488 Exposure of Data Element to Wrong Session
- CWE-613 Insufficient Session Expiration
- Fix
20.0.2- Upgrade org.keycloak:keycloak-parent to this version or later
Description
An issue was discovered in Keycloak when using a client with the offline_access scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user.
This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the offline_access scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.keycloak:keycloak-parent | < 20.0.2 |
20.0.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.keycloak:keycloak-parent Maven → 20.0.2
- maven
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-parent</artifactId><version>20.0.2</version></dependency>- gradle
implementation("org.keycloak:keycloak-parent:20.0.2")
Severity breakdown
CVSS 3.1 6.8
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CWE-304: Missing Critical Step in Authentication
The product implements an authentication technique, but it skips a step that weakens the technique.
CWE-488: Exposure of Data Element to Wrong Session
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
How to prevent it
- Architecture and Design: Protect the application's sessions from information leakage. Make sure that a session's data is not used or visible by other sessions.
- Testing: Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton Member Field).
- Architecture and Design: In a multithreading environment, storing user data in Servlet member fields introduces a data access race condition. Do not use member fields to store information in the Servlet.
CWE-613: Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
How to prevent it
- Implementation: Set sessions/credentials expiration date.
References
Advisories
Packages
Other links
- github.com/keycloak/keycloak/security/advisories/GHSA-97g8-xfvw-q4hg
- access.redhat.com/errata/RHSA-2022:8961
- access.redhat.com/errata/RHSA-2022:8962
- access.redhat.com/errata/RHSA-2022:8963
- access.redhat.com/errata/RHSA-2022:8964
- access.redhat.com/errata/RHSA-2022:8965
- access.redhat.com/errata/RHSA-2023:1043
- access.redhat.com/errata/RHSA-2023:1044
- access.redhat.com/errata/RHSA-2023:1045
- access.redhat.com/errata/RHSA-2023:1047
- access.redhat.com/errata/RHSA-2023:1049
- access.redhat.com/security/cve/CVE-2022-3916
- bugzilla.redhat.com/show_bug.cgi
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fwhw-chw4-gh37 Keycloak Server-Side Request Forgery (SSRF) vulnerability | Low | Also affects org.keycloak:keycloak-parent |
| GHSA-gv94-wp4h-vv8p Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | Medium | Also affects org.keycloak:keycloak-parent |
| GHSA-9hhc-pj4w-w5rv Keycloak Cross-site Scripting on OpenID connect login service | Medium | Also affects org.keycloak:keycloak-parent |
| GHSA-g8q8-fggx-9r3q Keycloak vulnerable to path traversal via double URL encoding | Critical | Also affects org.keycloak:keycloak-parent |
| GHSA-w9mf-83w3-fv49 Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles | Medium | Also affects org.keycloak:keycloak-parent |
| GHSA-wf7g-7h6h-678v Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console | High | Also affects org.keycloak:keycloak-parent |
| GHSA-xv7h-95r7-595j Incorrect implementation of lockout feature in Keycloak | High | Also affects org.keycloak:keycloak-parent |
| GHSA-jf86-9434-f8c2 Keycloak Authentication Error | Critical | Also affects org.keycloak:keycloak-parent |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor