The vulnerability exists due to an error in the authentication process in the Keycloak deployments with a reverse proxy not using pass-through termination of TLS and with enabled mTLS. A remote attacker can authenticate as any user or client that leverages mTLS as the authentication mechanism.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  CVE-2024-10039


Keycloak versions installed prior to 24.0.9, 25.0 prior to 26.0.6 are affected by multiple vulnerabilities as referenced in the advisory.

  - Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS     enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user      or client that leverages mTLS as the authentication mechanism. (CVE-2024-10039)

  - If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS)     scenario by exhausting system resources due to a Regex complexity. (CVE-2024-10270)

  - A user with high privileges could read sensitive information from a Vault file that is not within the     expected context. This attacker must have previous high access to the Keycloak server in order to perform     resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will     only inform whether that file exists or not. (CVE-2024-10492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
459946	Echo: org.keycloak:keycloak-core: security update to 26.0.6	Tenable Cloud Security	Echo Local Security Checks	Local	high
459946	Echo: org.keycloak:keycloak-core: security update to 26.0.6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
413006	SCA: security update for org.keycloak:keycloak-core (GHSA-93ww-43rr-79v3)	Tenable Cloud Security	SCA Checks	Local	high
413006	SCA: security update for org.keycloak:keycloak-core (GHSA-93ww-43rr-79v3)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
212078	Keycloak < 24.0.9, 25.0.x < 26.0.6 Multiple Vulnerabilities	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2024-10039

high

Tenable Plugins

high

high

high

high

high