Is CVE-2022-2237 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-2237 being exploited in the wild.

How severe is CVE-2022-2237?

Low severity, with a CVSS score of 3.1, published 2 March 2023.

Which products and versions are affected?

keycloak-connect (npm) SEMVER:introduced=0,fixed=21.0.1.

Is there a fix for CVE-2022-2237?

Yes. keycloak-connect (npm): upgrade to 21.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-2237 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-2237?

Check whether you run keycloak-connect (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-2237: Keycloak Node.js adapter open redirect in checkSSO

CVE-2022-2237 · Severity: low · CVSS 3.1 · Published 2023-03-02

The Keycloak Node.js adapter is an authentication library that integrates applications with Keycloak's identity management service. An open redirect vulnerability in the adapter's checkSSO feature allows attackers to redirect users to untrusted external websites by manipulating URLs with the 'prompt=none' query parameter, potentially enabling phishing attacks or session hijacking.

Technologies: keycloak-connect (npm). Vendors: npm.

Quick answers

Is CVE-2022-2237 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-2237 being exploited in the wild.
How severe is CVE-2022-2237?: Low severity, with a CVSS score of 3.1, published 2 March 2023.
Which products and versions are affected?: keycloak-connect (npm) SEMVER:introduced=0,fixed=21.0.1.
Is there a fix for CVE-2022-2237?: Yes. keycloak-connect (npm): upgrade to 21.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-2237 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-2237?: Check whether you run keycloak-connect (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keycloak-connect (npm): upgrade to 21.0.1 or later
```
npm install keycloak-connect@21.0.1
```

Technical details

This is a classic open redirect vulnerability (CWE-601) in the checkSSO middleware of keycloak-connect. When the adapter forwards requests to Keycloak with 'prompt=none', it constructs redirect URLs from user-controlled input without proper validation. The vulnerability allows an attacker to inject leading slashes or other URL manipulation techniques to bypass intended redirect restrictions. An unauthenticated attacker on the network can exploit this by crafting a malicious link and tricking users into clicking it; no user credentials or special privileges are required. The fix, released in version 21.0.1, collapses leading slashes in the redirect URL to prevent open redirects. All versions up to 18.0.1 are affected.

Affected products

Red Hat keycloak-connect <21.0.1

Identifiers

CVE-2022-2237
GHSA-59fq-727j-hm3f

Timeline

2023-03-02: disclosed
2023-03-02: patched: Fixed in version 21.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.