CVE-2024-11736

MEDIUM4.9

Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables

Published Jan 14, 2025

Modified 7 months ago

Details

A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.

References

ADVISORY

https://access.redhat.com/errata/RHSA-2025:0299

ADVISORY

https://access.redhat.com/errata/RHSA-2025:0300

WEB

https://access.redhat.com/security/cve/CVE-2024-11736

WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2328850

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2024-11736

CVSS Analysis