Keycloak vulnerable to log Injection during WebAuthn authentication or registration
Moderate severity
GitHub Reviewed
Published
Apr 17, 2024
in
keycloak/keycloak
•
Updated Apr 25, 2024
Package
Affected versions
< 22.0.9
>= 23.0.0, < 23.0.5
Patched versions
22.0.9
23.0.5
Description
Published to the GitHub Advisory Database
Apr 17, 2024
Reviewed
Apr 17, 2024
Published by the National Vulnerability Database
Apr 25, 2024
Last updated
Apr 25, 2024
A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection.
Acknowledgements:
Special thanks toTheresa Henze for reporting this issue and helping us improve our security.
References