GitHub Advisoryadvisory · Maven

GHSA-m6q9-p373-g5q8 Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

HIGH Published 2024-04-17 Modified 2024-06-24 Official page ↗
Aliases
CVE-2024-1249
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
Weaknesses
CWE-346
Reviewed
2024-04-17

Affected packages

• Maven org.keycloak:keycloak-services: < 22.0.10 → fixed in 22.0.10 • Maven org.keycloak:keycloak-services: >= 23.0.0, < 24.0.3 → fixed in 24.0.3

Description

A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages. Acknowledgements Special thanks to Adriano Márcio Monteiro from BRZTEC for reporting this issue and helping us improve our project.

Related

Alias · CVE (1)

  • CVE-2024-1249 A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. vulnerability

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References