A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment
    variables and system properties through user-configurable URLs. When configuring backchannel logout URLs
    or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server
    replaces these placeholders with the actual values of environment variables or system properties during
    URL processing. (CVE-2024-11736)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 5e2bd238-d2bb-11ef-bc0e-1c697a616631 advisory.

    Keycloak reports:
    This update includes 2 security fixes:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Keycloak installed on the remote host is prior to 26.0.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 26_0_8 advisory.

  - A denial of service vulnerability was found in Keycloak that could allow an administrative user with the     right to change realm settings to disrupt the service. This action is done by modifying any of the     security headers and inserting newlines, which causes the Keycloak server to write to a request that has     already been terminated, leading to the failure of said request. (CVE-2024-11734)

  - A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment     variables and system properties through user-configurable URLs. When configuring backchannel logout URLs     or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server     replaces these placeholders with the actual values of environment variables or system properties during     URL processing. (CVE-2024-11736)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
414263	SCA: security update for org.keycloak:keycloak-quarkus-server (GHSA-f4v7-3mww-9gc2)	Tenable Cloud Security	SCA Checks	medium
414263	SCA: security update for org.keycloak:keycloak-quarkus-server (GHSA-f4v7-3mww-9gc2)	Tenable Self-Hosted Container Security	SCA Checks	medium
214220	FreeBSD : keycloak -- Multiple security fixes (5e2bd238-d2bb-11ef-bc0e-1c697a616631)	Nessus	FreeBSD Local Security Checks	medium
214216	Keycloak 26.0.8 Multiple Vulnerabilities (26_0_8)	Nessus	Misc.	medium

Detections

Analytics

CVE-2024-11736

medium

Tenable Plugins

medium

medium

medium

medium