Keycloak: amount of attributes per object is not limited and it may lead to dos

Vulnerability

Overview CVE-2023-6841 is a denial of service (DoS) vulnerability in Keycloak caused by the absence of a limit on the number of attributes per object. When an application returns rows with long attribute values, repeated HTTP requests can lead to resource exhaustion [1][2][3].

Exploitation

An attacker can exploit this by sending multiple HTTP requests that trigger the retrieval of objects with many or long attributes. No special privileges are required; the attacker only needs network access to the Keycloak instance [2].

Impact

Successful exploitation results in resource exhaustion, potentially causing the Keycloak service to become unresponsive or crash, leading to denial of service for legitimate users [3].

Mitigation

The vulnerability is addressed in Keycloak version 24.0.0, which introduces fine-grained control over user attributes and limits on attribute counts [1]. Users should upgrade to this version or later to mitigate the risk [2].