Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-mpwq-j3xf-7m5w
Advisory ID github_osv/GHSA-mpwq-j3xf-7m5w
Aliases CVE-2023-6291
Summary The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts. The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "[www%2ekeycloak%2eorg%2fapp%2f:y@example.com](https://www%2ekeycloak%2eorg%2fapp%2f:y@example.com/)" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input. ### Acknowledgements Karel Knibbe
Status Published
Exploitability 0.5
Weighted Severity 6.4
Risk 3.2
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
cvssv3.1 7.1 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-mpwq-j3xf-7m5w/GHSA-mpwq-j3xf-7m5w.json
generic_textual HIGH
Reference id Reference type URL
https://bugzilla.redhat.com/show_bug.cgi?id=2251407
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/b2e91105315ccf2c1df549b4f6c5948322cbfd1b
CVE-2023-6291 https://access.redhat.com/security/cve/CVE-2023-6291
CVE-2023-6291 https://nvd.nist.gov/vuln/detail/CVE-2023-6291
GHSA-mpwq-j3xf-7m5w https://github.com/keycloak/keycloak/security/advisories/GHSA-mpwq-j3xf-7m5w
RHSA-2023:7854 https://access.redhat.com/errata/RHSA-2023:7854
RHSA-2023:7855 https://access.redhat.com/errata/RHSA-2023:7855
RHSA-2023:7856 https://access.redhat.com/errata/RHSA-2023:7856
RHSA-2023:7857 https://access.redhat.com/errata/RHSA-2023:7857
RHSA-2023:7858 https://access.redhat.com/errata/RHSA-2023:7858
RHSA-2023:7860 https://access.redhat.com/errata/RHSA-2023:7860
RHSA-2023:7861 https://access.redhat.com/errata/RHSA-2023:7861
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-mpwq-j3xf-7m5w/GHSA-mpwq-j3xf-7m5w.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2023/6xxx/CVE-2023-6291.json

Source Advisory: vulnrichment/CVE-2023-6291

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]