Bug 2158585 (CVE-2023-0091) - CVE-2023-0091 keycloak: Client Registration endpoint does not check token revocation
Summary: CVE-2023-0091 keycloak: Client Registration endpoint does not check token rev...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-0091
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2158586
TreeView+ depends on / blocked
 
Reported: 2023-01-05 18:56 UTC by mulliken
Modified: 2023-03-02 01:50 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.
Clone Of:
Environment:
Last Closed: 2023-03-02 01:50:58 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:1043 0 None None None 2023-03-01 21:44:11 UTC
Red Hat Product Errata RHSA-2023:1044 0 None None None 2023-03-01 21:46:41 UTC
Red Hat Product Errata RHSA-2023:1045 0 None None None 2023-03-01 21:49:07 UTC
Red Hat Product Errata RHSA-2023:1047 0 None None None 2023-03-01 21:50:05 UTC
Red Hat Product Errata RHSA-2023:1049 0 None None None 2023-03-01 22:00:14 UTC

Description mulliken 2023-01-05 18:56:21 UTC 
/clients-registrations/openid-connect could consume an invalidated token and register a new client.

Reproducer:
1. Generate a token for service-account using the client_credentials flow
2. Revoke the token using the /revoke endpoint passing in the above token.
3. Now, invoke /clients-registrations/openid-connect passing in the above generated token for auth
4. A client is created using the token
Comment 6 Patrick Del Bello 2023-02-22 14:37:29 UTC 
CVSS Explanation on privileges required:

Privileges Required: (H) instead of (N)

The CVSS Metric for Privileges Required is expected to be "High". This is explained in the flaw description as the attacker requires access to the access token that was meant to be revoked. This follows the CVSS Metric Definition: "The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable component allowing access to component-wide settings and files."
Considering the above information, a previous privilege is require prior the attacker jeopardize the environment.
Comment 7 errata-xmlrpc 2023-03-01 21:44:09 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 7

Via RHSA-2023:1043 https://access.redhat.com/errata/RHSA-2023:1043
Comment 8 errata-xmlrpc 2023-03-01 21:46:39 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 8

Via RHSA-2023:1044 https://access.redhat.com/errata/RHSA-2023:1044
Comment 9 errata-xmlrpc 2023-03-01 21:49:06 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 9

Via RHSA-2023:1045 https://access.redhat.com/errata/RHSA-2023:1045
Comment 10 errata-xmlrpc 2023-03-01 21:50:04 UTC 
This issue has been addressed in the following products:

  RHEL-8 based Middleware Containers

Via RHSA-2023:1047 https://access.redhat.com/errata/RHSA-2023:1047
Comment 11 errata-xmlrpc 2023-03-01 22:00:13 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2023:1049 https://access.redhat.com/errata/RHSA-2023:1049
Comment 12 Product Security DevOps Team 2023-03-02 01:50:56 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-0091
Note You need to log in before you can comment on or make changes to this bug.