Red Hat Build of Keycloak Redirect URI redirect

Summaryinfo

A vulnerability has been found in Red Hat Build of Keycloak, JBoss Enterprise Application Platform and Single Sign-On and classified as problematic. Affected by this issue is some unknown functionality of the component Redirect URI Handler. Performing a manipulation results in redirect. This vulnerability is cataloged as CVE-2024-8883. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Red Hat Build of Keycloak, JBoss Enterprise Application Platform and Single Sign-On (the affected version unknown). It has been classified as problematic. This affects an unknown part of the component Redirect URI Handler. The manipulation with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on integrity. The summary by CVE is:

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

The advisory is shared at access.redhat.com. This vulnerability is uniquely identified as CVE-2024-8883 since 09/16/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/31/2025). MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 210339 (RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.0.4 Security update (Important) (RHSA-2024:8823)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (210339) and EUVD (EUVD-2024-3152). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Red Hat

Name

• Build of Keycloak
• JBoss Enterprise Application Platform
• Single Sign-On

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion