CVE-2023-6134
published 2023-12-14CVE-2023-6134: A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an…
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.91%
56.1th percentile
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | keycloak | < 22.0.7 | 22.0.7 |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | openshift_container_platform_ibm_z_systems | — | — |
| redhat | openshift_container_platform_ibm_z_systems | — | — |
| redhat | single_sign-on | < 7.6 | 7.6 |
| redhat | single_sign-on | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
ghsa5.4MEDIUM
osv5.4MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
keycloak: open redirect via "form_post.jwt" JARM response mode
vendor_redhat·2023-12-18·CVSS 4.6
CVE-2023-6927 [MEDIUM] CWE-601 keycloak: open redirect via "form_post.jwt" JARM response mode
keycloak: open redirect via "form_post.jwt" JARM response mode
A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.
A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.
Statement: Red Hat rates this as a moderate, following the same case for CVE-2023-6134, but with another response mode with JSON Web Token.
Mitigation: Mitigation for this issue is either not available or the cu
Red Hat
keycloak-core: Reflected XSS via wildcard in OIDC redirect_uri. Incomplete fix of CVE-2023-6134
vendor_redhat·2023-12-18·CVSS 4.6
CVE-2023-6920 [MEDIUM] CWE-75 keycloak-core: Reflected XSS via wildcard in OIDC redirect_uri. Incomplete fix of CVE-2023-6134
keycloak-core: Reflected XSS via wildcard in OIDC redirect_uri. Incomplete fix of CVE-2023-6134
An incomplete fix was found in the Keycloak Core patch. An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt". Changing the response_mode parameter in the original proof of concept from "form_post" to "form_post.jwt" can bypass the security patch implemented to address CVE-2023-6134.
Statement: This flaw was found to be a duplicate of CVE-2023-6927. Please see https://access.redhat.com/security/cve/CVE-2023-6927 for information about affected products and security errata.
Mitigation: No current mitigation is available for this flaw.
Package: keycloak-core (Red Hat Build of Keycloak) - Affected
Package: rh-sso7-keycloak (R
Red Hat
keycloak: reflected XSS via wildcard in OIDC redirect_uri
vendor_redhat·2023-11-14·CVSS 6.1
CVE-2023-6134 [MEDIUM] CWE-79 keycloak: reflected XSS via wildcard in OIDC redirect_uri
keycloak: reflected XSS via wildcard in OIDC redirect_uri
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
GHSA
keycloak-core: open redirect via "form_post.jwt" JARM response mode
ghsa·2024-01-23·CVSS 5.4
CVE-2023-6927 [MEDIUM] CWE-601 keycloak-core: open redirect via "form_post.jwt" JARM response mode
keycloak-core: open redirect via "form_post.jwt" JARM response mode
An incomplete fix was found in Keycloak Core patch. An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt". It is observed that changing the response_mode parameter in the original proof of concept from "form_post" to "form_post.jwt" can bypass the security patch implemented to address CVE-2023-6134.
OSV
keycloak-core: open redirect via "form_post.jwt" JARM response mode
osv·2024-01-23·CVSS 5.4
CVE-2023-6927 [MEDIUM] keycloak-core: open redirect via "form_post.jwt" JARM response mode
keycloak-core: open redirect via "form_post.jwt" JARM response mode
An incomplete fix was found in Keycloak Core patch. An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt". It is observed that changing the response_mode parameter in the original proof of concept from "form_post" to "form_post.jwt" can bypass the security patch implemented to address CVE-2023-6134.
OSV
Duplicate Advisory: Keycloak Open Redirect vulnerability
osv·2023-12-19·CVSS 5.4
[MEDIUM] Duplicate Advisory: Keycloak Open Redirect vulnerability
Duplicate Advisory: Keycloak Open Redirect vulnerability
# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9vm7-v8wj-3fqw. This link is maintained to preserve external references.
# Original Description
A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.
GHSA
Duplicate Advisory: Keycloak Open Redirect vulnerability
ghsa·2023-12-19·CVSS 5.4
[MEDIUM] CWE-601 Duplicate Advisory: Keycloak Open Redirect vulnerability
Duplicate Advisory: Keycloak Open Redirect vulnerability
# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9vm7-v8wj-3fqw. This link is maintained to preserve external references.
# Original Description
A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.
GHSA
Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri
ghsa·2023-12-18
CVE-2023-6134 [MEDIUM] CWE-75 Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri
Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri
Keycloak prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This could permit an attacker to submit a specially crafted request leading to XSS or possibly further attacks.
OSV
Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri
osv·2023-12-18
CVE-2023-6134 [MEDIUM] Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri
Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri
Keycloak prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This could permit an attacker to submit a specially crafted request leading to XSS or possibly further attacks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/errata/RHSA-2023:7854https://access.redhat.com/errata/RHSA-2023:7855https://access.redhat.com/errata/RHSA-2023:7856https://access.redhat.com/errata/RHSA-2023:7857https://access.redhat.com/errata/RHSA-2023:7858https://access.redhat.com/errata/RHSA-2023:7860https://access.redhat.com/errata/RHSA-2023:7861https://access.redhat.com/errata/RHSA-2024:0798https://access.redhat.com/errata/RHSA-2024:0799https://access.redhat.com/errata/RHSA-2024:0800https://access.redhat.com/errata/RHSA-2024:0801https://access.redhat.com/errata/RHSA-2024:0804https://access.redhat.com/security/cve/CVE-2023-6134https://bugzilla.redhat.com/show_bug.cgi?id=2249673https://access.redhat.com/errata/RHSA-2023:7854https://access.redhat.com/errata/RHSA-2023:7855https://access.redhat.com/errata/RHSA-2023:7856https://access.redhat.com/errata/RHSA-2023:7857https://access.redhat.com/errata/RHSA-2023:7858https://access.redhat.com/errata/RHSA-2023:7860https://access.redhat.com/errata/RHSA-2023:7861https://access.redhat.com/errata/RHSA-2024:0798https://access.redhat.com/errata/RHSA-2024:0799https://access.redhat.com/errata/RHSA-2024:0800https://access.redhat.com/errata/RHSA-2024:0801https://access.redhat.com/errata/RHSA-2024:0804https://access.redhat.com/security/cve/CVE-2023-6134https://bugzilla.redhat.com/show_bug.cgi?id=2249673
2023-12-14
Published