Executive brief
The Keycloak Node.js adapter is an authentication library that integrates applications with Keycloak's identity management service. An open redirect vulnerability in the adapter's checkSSO feature allows attackers to redirect users to untrusted external websites by manipulating URLs with the 'prompt=none' query parameter, potentially enabling phishing attacks or session hijacking.
Technical details
This is a classic open redirect vulnerability (CWE-601) in the checkSSO middleware of keycloak-connect. When the adapter forwards requests to Keycloak with 'prompt=none', it constructs redirect URLs from user-controlled input without proper validation. The vulnerability allows an attacker to inject leading slashes or other URL manipulation techniques to bypass intended redirect restrictions. An unauthenticated attacker on the network can exploit this by crafting a malicious link and tricking users into clicking it; no user credentials or special privileges are required. The fix, released in version 21.0.1, collapses leading slashes in the redirect URL to prevent open redirects. All versions up to 18.0.1 are affected.
Affected products
- Red Hat keycloak-connect <21.0.1
Timeline
- 2023-03-02: disclosed
- 2023-03-02: patched: Fixed in version 21.0.1