Keycloak-core: open redirect on account page

Vulnerability

Description

Keycloak is vulnerable to an open redirect flaw (CVE-2024-7260) where specially crafted URLs using the referrer and referrer_uri parameters can redirect users to an attacker-controlled malicious webpage [1][2]. The root cause lies in insufficient validation of these parameters, allowing a trusted-looking Keycloak URL to actually redirect to an arbitrary external site [1][2].

Exploitation

A crafted URL can be sent to a Keycloak admin via email or other channels; when the admin visits the page and clicks the link, the redirect is triggered [2]. The attack does not require authentication on the part of the target, but the victim must be a Keycloak user (often an admin) who interacts with the malicious link [2]. An attacker can further obfuscate the redirect_uri using URL encoding to hide the malicious domain, making the link appear more legitimate [2]. It also may be possible to bypass OAuth redirect URI checks by supplying this crafted parameter as part of an OAuth flow [2].

Impact

A successful exploit can lead a victim to trust a malicious destination, enabling phishing attacks or other social engineering schemes [1][2]. Since the initial URL appears to be a legitimate Keycloak endpoint, the victim may disclose credentials or sensitive information to the attacker's server [1][2]. This vulnerability can also be leveraged to bypass domain-related security constraints that rely on proper redirect validation [2].

Mitigation

Red Hat has addressed this vulnerability in Keycloak version 24.0.7 images released in RHSA-2024:6502 [3]. Users should update their Keycloak deployments to this or a later patched version to mitigate the risk [3]. The advisory also notes that this fix is available for Red Hat build of Keycloak for OpenShift [3].