Bug 1868580

Summary: keycloak: host header poisoning vulnerability
Product: [Other] Security Response Reporter: Dhananjay Arunesh <darunesh>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, aschwart, avibelli, bgeorges, boliveir, chazlett, cmoulliard, dhanak, dkreling, drieden, drosa, etirelli, ggaughan, gmalinko, ibek, ikanello, janstey, jbalunas, jochrist, jpallich, jrokos, jstastny, jwon, krathod, kverlaen, lthon, mnovotny, mposolda, mszynkie, paradhya, pdelbell, pdrozd, pgallagh, pjindal, rrajasek, rruss, rstepani, rsynek, sausingh, sdaley, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-08-20 05:29:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1854400    

Description Dhananjay Arunesh 2020-08-13 08:04:05 UTC 
A vulnerability was found in keycloak, where it is common for password reset functionality to include the Host header value when creating password reset links that use a generated secret token. If the application processes an attacker-controlled domain to create a password reset link, the victim may click on the link in the email and allow the attacker to obtain the reset token, thus resetting the victim’s password.

References:
https://issues.redhat.com/browse/KEYCLOAK-14656
Comment 7 Paramvir jindal 2020-08-20 05:17:01 UTC 
Red Hat Product Security does not consider this to be a vulnerability. As it is recommended to use Keycloak with a hostname, or a reverse proxy should be placed in front of Keycloak that validates the Host header
Comment 8 Paramvir jindal 2020-08-20 05:20:22 UTC 
Statement:

Red Hat Product Security does not consider this to be a vulnerability. As it is recommended to use Keycloak with a hostname, or a reverse proxy should be placed in front of Keycloak that validates the Host header.

https://www.keycloak.org/docs/latest/server_installation/#_hostname