A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the client_session_host parameter during refresh token requests. This occurs when a Keycloak client is configured to use the backchannel.logout.url with the application.session.host placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
Weakness
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Build_of_keycloak | Redhat | - (including) | - (including) |
| Jboss_enterprise_application_platform | Redhat | 8.0.0 (including) | 8.0.0 (including) |
| Jboss_enterprise_application_platform_expansion_pack | Redhat | - (including) | - (including) |
| Single_sign-on | Redhat | 7.0 (including) | 7.0 (including) |
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-operator-bundle:26.4.13-1 | * |
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-rhel9:26.4-19 | * |
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-rhel9-operator:26.4-19 | * |
| Red Hat build of Keycloak 26.4.13 | RedHat | rhbk/keycloak-rhel9 | * |
| Red Hat build of Keycloak 26.6 | RedHat | rhbk/keycloak-operator-bundle:26.6.3-3 | * |
| Red Hat build of Keycloak 26.6 | RedHat | rhbk/keycloak-rhel9:26.6-6 | * |
| Red Hat build of Keycloak 26.6 | RedHat | rhbk/keycloak-rhel9-operator:26.6-6 | * |
| Red Hat build of Keycloak 26.6.3 | RedHat | rhbk/keycloak-rhel9 | * |