Privilege Escalation Affecting org.keycloak:keycloak-services package, versions [,3.3.0.Final)


0.0
high

Snyk CVSS

    Attack Complexity Low
    Privileges Required High
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    EPSS 0.17% (54th percentile)
Expand this section
NVD
7.2 high
Expand this section
Red Hat
3.1 low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGKEYCLOAK-31564
  • published 5 Nov 2017
  • disclosed 15 Oct 2017
  • credit Bart Toersche

How to fix?

Upgrade org.keycloak:keycloak-services to version 3.3.0.Final or higher.

Overview

org.keycloak:keycloak-services is an open Source Identity and Access Management for modern Applications and Services.

Affected versions of the package are vulnerable to Privilege Escalation. It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks