// For flags

CVE-2024-11736

Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables

Severity Score

4.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.

Se encontró una vulnerabilidad en Keycloak. Los usuarios administradores pueden tener que acceder a variables de entorno de servidor confidenciales y propiedades del sistema a través de URL configurables por el usuario. Al configurar las URL de cierre de sesión de backchannel o las URL de administrador, los usuarios administradores pueden incluir marcadores de posición como ${env.VARNAME} o ${PROPNAME}. El servidor reemplaza estos marcadores de posición con los valores reales de las variables de entorno o las propiedades del sistema durante el procesamiento de URL.

*Credits: This issue was discovered by Steven Hawkins (Red Hat).
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Multiple
Confidentiality
Complete
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-11-26 CVE Reserved
  • 2025-01-14 CVE Published
  • 2025-03-19 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Redhat
Search vendor "Redhat"
 Build Keycloak
Search vendor "Redhat" for product "Build Keycloak"
*-
Affected
Redhat
Search vendor "Redhat"
 Build Of Keycloak
Search vendor "Redhat" for product "Build Of Keycloak"
*-
Affected
Redhat
Search vendor "Redhat"
 Jboss Enterprise Application Platform
Search vendor "Redhat" for product "Jboss Enterprise Application Platform"
*-
Affected
Redhat
Search vendor "Redhat"
 Jbosseapxp
Search vendor "Redhat" for product "Jbosseapxp"
*-
Affected