Bug 2097007 (CVE-2022-2237)

Summary:	CVE-2022-2237 Keycloak Node.js Adapter: Open redirect vulnerability in checkSSO
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, alampare, alazarot, anstephe, ataylor, avibelli, bbuckingham, bcourt, bgeorges, bmontgom, boliveir, chazlett, clement.escoffier, cmoulliard, dandread, dffrench, dhanak, dkreling, ehelms, emingora, eparis, gjospin, gmalinko, gsmet, gzaronik, ibek, janstey, jburrell, jmartisk, jochrist, jokerman, jrokos, jsherril, jwon, kverlaen, lbacciot, lthon, lzap, max.andersen, mhulan, mnovotny, ngough, nmoumoul, nstielau, orabin, pcreech, pdelbell, pdrozd, peholase, pgallagh, pjindal, probinso, pskopek, rchan, rgodfrey, rguimara, rkieley, rruss, rsvoboda, sbiarozk, sponnaga, sthorger
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2097384
Bug Blocks:	2097008, 2101668

Description Pedro Sampaio 2022-06-14 17:11:42 UTC

checkSSO uses the query param 'prompt=none' when forwarding the request to KeyCloak. This may allow authenticating the user without interaction as long as the user is already authenticated with KeyCloak.

Comment 13 errata-xmlrpc 2023-03-01 21:58:47 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2023:1049 https://access.redhat.com/errata/RHSA-2023:1049