Bug 2007512 (CVE-2021-3827)

Summary:	CVE-2021-3827 keycloak-server-spi-private: ECP SAML binding bypasses authentication flows
Product:	[Other] Security Response	Reporter:	Paramvir jindal <pjindal>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboyko, chazlett, drieden, jochrist, jross, jwon, krathod, pdrozd, pjindal, rgodfrey, sthorger
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	keycloak-server-spi-private 18.0.0	Doc Type:	---
Doc Text:	A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-01-17 22:30:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2007506

Description Paramvir jindal 2021-09-24 06:19:53 UTC

For each SAML client it is possible to send an AuthnRequest message via SOAP with Basic Authorization header and Keycloak will successfully authenticate the user for the client and will not consider the authentication flow applied.

The presence of the flow is hidden from the administrator, it is not possible to disable it in the client's configuration similarly as direct grant etc.

https://issues.redhat.com/browse/KEYCLOAK-19177

Comment 1 Paramvir jindal 2021-09-24 06:21:07 UTC

Issue can be replicated in RHSSO 7.5 hence I am marking it as affected/fix and creating tracker.

Comment 5 errata-xmlrpc 2022-01-17 21:30:32 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.5 for RHEL 8

Via RHSA-2022:0152 https://access.redhat.com/errata/RHSA-2022:0152

Comment 6 errata-xmlrpc 2022-01-17 21:31:23 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.5 for RHEL 7

Via RHSA-2022:0151 https://access.redhat.com/errata/RHSA-2022:0151

Comment 7 errata-xmlrpc 2022-01-17 21:46:34 UTC

This issue has been addressed in the following products:

  RHSSO 7.5.1

Via RHSA-2022:0155 https://access.redhat.com/errata/RHSA-2022:0155

Comment 8 Product Security DevOps Team 2022-01-17 22:30:34 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3827

Comment 9 errata-xmlrpc 2022-01-18 14:53:51 UTC

This issue has been addressed in the following products:

  RHEL-8 based Middleware Containers

Via RHSA-2022:0164 https://access.redhat.com/errata/RHSA-2022:0164