Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

高 7.4CVE-2024-1249 · GHSA-m6q9-p373-g5q8 · 17/04/2024 公開 · 27/10/2026 更新

要点

CVE-2024-1249 は org.keycloak:keycloak-services に影響する深刻度「高」 (CVSS 7.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.45%（全脆弱性の 39.0% より高い）。
対処：24.0.3, 22.0.10 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.keycloak:keycloak-services Maven	`≥ 23.0.0, < 24.0.3< 22.0.10`	`24.0.322.0.10`

概要

A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

Acknowledgements

Special thanks to Adriano Márcio Monteiro from BRZTEC for reporting this issue and helping us improve our project.

NVD の説明

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.