2024-11-28
Keycloak versions 26 and earlier are susceptible to a critical denial-of-service (DoS) vulnerability (CVE-2023-4634). This vulnerability arises from improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may inadvertently accept non-IP values like obfuscated identifiers without adequate validation. This oversight can lead to expensive DNS resolution operations, which a malicious actor could exploit to exhaust system resources and trigger a denial-of-service condition.
To successfully exploit this vulnerability, an attacker must have the ability to send requests to a Keycloak instance configured to accept proxy headers. This is particularly relevant when reverse proxies do not overwrite incoming headers and Keycloak is configured to trust these headers.
For Keycloak version 26, successful exploitation requires the following conditions:
The realm must have SslRequired=EXTERNAL (the default setting).
HTTP must be enabled.
The instance must not employ a full hostname URL.
Access must originate from behind a proxy, assuming the proxy overwrites the X-Forwarded-For header.
Trusted proxies must not be configured or must incorrectly trust the client sending the request.
Form:
Platform: Keycloak
Version: 26 and earlier
Vulnerability: Denial-of-Service (DoS)
Severity: Critical
Date: 2023-11-21
What Undercode Says:
This is a critical vulnerability that could allow attackers to take down Keycloak servers. It’s important to patch your Keycloak instances to the latest version as soon as possible. If you can’t patch immediately, you can mitigate the risk by disabling proxy header support or configuring trusted proxies correctly.
This vulnerability highlights the importance of keeping your software up-to-date and configured securely. It’s also a good reminder to be careful about which proxy headers you trust.
Additional Considerations:
If you’re using a load balancer or reverse proxy in front of Keycloak, make sure it’s configured to properly handle and forward proxy headers.
Consider using a web application firewall (WAF) to help protect your Keycloak instance from attacks.
Keep an eye on the Keycloak security advisories for information about new vulnerabilities and patches.
By taking these steps, you can help protect your Keycloak instances from this and other vulnerabilities.
References:
Reported By: Github.com
Undercode AI: https://ai.undercodetesting.com
Image Source:
OpenAI: https://openai.com
Undercode AI DI v2: https://ai.undercode.help