Detections
Analytics

SCA: security update for @dapperduckling/keycloak-connector-server (GHSA-w5rq-g9r6-vrcg)

high Tenable Self-Hosted Container Security Plugin ID 419732

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - @dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications
 and frontend clients to interface with keycloak. A Reflected Cross-Site Scripting (XSS) vulnerability was
 discovered in the authentication flow of the application. This issue arises due to improper sanitization
 of the URL parameters, allowing the URL bar's contents to be injected and reflected into the HTML page. An
 attacker could craft a malicious URL to execute arbitrary JavaScript in the browser of a victim who visits
 the link. Any application utilizing this authentication library is vulnerable. Users of the application
 are at risk if they can be lured into clicking on a crafted malicious link. The vulnerability has been
 patched in version 2.5.5 by ensuring proper sanitization and escaping of user input in the affected URL
 parameters. Users are strongly encouraged to upgrade. If upgrading is not immediately possible, users can
 implement the following workarounds: 1. Employ a Web Application Firewall (WAF) to block malicious
 requests containing suspicious URL parameters. or 2. Apply input validation and escaping directly within
 the application’s middleware or reverse proxy layer, specifically targeting the affected parameters.
 (CVE-2024-53843)

See Also

https://github.com/advisories/GHSA-w5rq-g9r6-vrcg

Plugin Details

Severity: High

ID: 419732

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.2

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2024-53843

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.6

Threat Score: 6.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/26/2024

Vulnerability Publication Date: 11/25/2024

Reference Information

CVE: CVE-2024-53843

cwe: CWE-79