CVE-2024-1249 Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos
A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.
Problem types: cwe_id: CWE-346
description: Origin Validation Error
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat AMQ Broker 7
cpes: cpe:/a:redhat:amq_broker:7.12
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 22
cpes: cpe:/a:redhat:build_keycloak:22::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 22.0.10
cpes: cpe:/a:redhat:build_keycloak:22
default_status: unaffected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
default_status: affected
vendor: Red Hat
product: RHEL-8 based Middleware Containers
cpes: cpe:/a:redhat:rhosemc:1.0::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHOSS-1.33-RHEL-8
cpes: cpe:/a:redhat:openshift_serverless:1.33::el8
default_status: affected
vendor: Red Hat
product: RHSSO 7.6.8
cpes: cpe:/a:redhat:red_hat_single_sign_on:7.6
default_status: unaffected
vendor: Red Hat
product: Migration Toolkit for Applications 6
cpes: cpe:/a:redhat:migration_toolkit_applications:6
default_status: affected
vendor: Red Hat
product: Migration Toolkit for Applications 7
cpes: cpe:/a:redhat:migration_toolkit_applications:7
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Apicurio Registry 2
cpes: cpe:/a:redhat:service_registry:2
default_status: affected
vendor: Red Hat
product: Red Hat Data Grid 8
cpes: cpe:/a:redhat:jboss_data_grid:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Decision Manager 7
cpes: cpe:/a:redhat:jboss_enterprise_brms_platform:7
default_status: affected
vendor: Red Hat
product: Red Hat Developer Hub
cpes: cpe:/a:redhat:rhdh:1
default_status: unaffected
vendor: Red Hat
product: Red Hat Fuse 7
cpes: cpe:/a:redhat:jboss_fuse:7
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
cpes: cpe:/a:redhat:jboss_data_grid:7
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: unaffected
vendor: Red Hat
product: Red Hat Process Automation 7
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
default_status: affected
vendor: Red Hat
product: streams for Apache Kafka
cpes: cpe:/a:redhat:amq_streams:1
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Adriano Márcio Monteiro for reporting this issue.
Published: 2024-04-17T13:22:48.335Z