CVE-2024-4540

Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.

Se encontró una falla en Keycloak en las solicitudes de autorización push (PAR) de OAuth 2.0. Se descubrió que los parámetros proporcionados por el cliente estaban incluidos en texto plano en la cookie KC_RESTART devuelta por la respuesta HTTP del servidor de autorización a una solicitud de autorización `request_uri`, lo que posiblemente conduzca a una vulnerabilidad de divulgación de información.

New images are available for Red Hat build of Keycloak 22.0.11 and Red Hat build of Keycloak 22.0.11 Operator, running on OpenShift Container Platform.

*Credits: Red Hat would like to thank Manuel Schallar for reporting this issue.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-06 CVE Reserved
2024-06-03 CVE Published
2024-11-13 CVE Updated
2025-07-12 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CAPEC

References (11)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2024:3566	2024-06-03
https://access.redhat.com/errata/RHSA-2024:3567	2024-06-03
https://access.redhat.com/errata/RHSA-2024:3568	2024-06-03
https://access.redhat.com/errata/RHSA-2024:3570	2024-06-03
https://access.redhat.com/errata/RHSA-2024:3572	2024-06-03
https://access.redhat.com/errata/RHSA-2024:3573	2024-06-03
https://access.redhat.com/errata/RHSA-2024:3574	2024-06-03
https://access.redhat.com/errata/RHSA-2024:3575	2024-06-03
https://access.redhat.com/errata/RHSA-2024:3576	2024-06-03
https://access.redhat.com/security/cve/CVE-2024-4540	2024-06-03
https://bugzilla.redhat.com/show_bug.cgi?id=2279303	2024-06-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"		Build Keycloak Search vendor "Redhat" for product "Build Keycloak"				*		-		Affected
Redhat Search vendor "Redhat"		Red Hat Single Sign On Search vendor "Redhat" for product "Red Hat Single Sign On"				*		-		Affected
Redhat Search vendor "Redhat"		Rhosemc Search vendor "Redhat" for product "Rhosemc"				*		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				*		-		Affected