A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service. The attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service
    (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming
    proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation.
    This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO
    threads and potentially cause a denial of service. The attacker must have access to send requests to a
    Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not
    overwrite incoming headers, and Keycloak is configured to trust these headers. (CVE-2024-9666)

Keycloak versions installed prior to 24.0.9, 25.0 prior to 26.0.6 are affected by multiple vulnerabilities as referenced in the advisory.

  - Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS     enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user      or client that leverages mTLS as the authentication mechanism. (CVE-2024-10039)

  - If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS)     scenario by exhausting system resources due to a Regex complexity. (CVE-2024-10270)

  - A user with high privileges could read sensitive information from a Vault file that is not within the     expected context. This attacker must have previous high access to the Keycloak server in order to perform     resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will     only inform whether that file exists or not. (CVE-2024-10492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
457822	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-quarkus-server: security update to 26.0.6	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457822	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-quarkus-server: security update to 26.0.6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
416367	SCA: security update for org.keycloak:keycloak-quarkus-server (GHSA-jgwc-jh89-rpgq)	Tenable Cloud Security	SCA Checks	Local	medium
416367	SCA: security update for org.keycloak:keycloak-quarkus-server (GHSA-jgwc-jh89-rpgq)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
212078	Keycloak < 24.0.9, 25.0.x < 26.0.6 Multiple Vulnerabilities	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2024-9666

medium

Tenable Plugins

medium

medium

medium

medium

high