Keycloak Authorization Bypass vulnerability

中 5.4CVE-2023-6544 · GHSA-46c8-635v-68r2 · 25/04/2024 公開 · 17/06/2026 更新

要点

CVE-2023-6544 は org.keycloak:keycloak-services に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.1%（全脆弱性の 65.1% より高い）。
対処：24.0.3, 22.0.10 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.keycloak:keycloak-services Maven	`≥ 23.0.0, < 24.0.3< 22.0.10`	`24.0.322.0.10`

概要

Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, a malicious user with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized.

Acknowledgements:

Special thanks to Bastian Kanbach for reporting this issue and helping us improve our security.

NVD の説明

A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with this specific Dynamic Client Registration and TrustedDomain configuration previously unauthorized.