Description

CVE-2024-4540 is a vulnerability in Keycloak's OAuth 2.0 Pushed Authorization Requests (PAR) implementation. It allows an attacker to disclose sensitive information by including client-provided parameters in plain text in the KC_RESTART cookie. This vulnerability has a CVSS score of 7.5, indicating a high severity. However, SOCRadar's Vulnerability Risk Score (SVRS) is 0, suggesting that the vulnerability is not currently being actively exploited.

Key Insights

• Information Disclosure: This vulnerability allows an attacker to access sensitive information, such as user credentials or session tokens, by exploiting the flaw in Keycloak's PAR implementation.
• Active Exploitation: The vulnerability is actively exploited in the wild, indicating that attackers are aware of it and are using it to compromise systems.
• CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about this vulnerability, urging organizations to take immediate action to mitigate the risk.

Mitigation Strategies

• Update Keycloak: The vendor has released a patch to address this vulnerability. Organizations should update their Keycloak installations to the latest version as soon as possible.
• Disable PAR: If updating Keycloak is not immediately feasible, organizations can disable PAR to mitigate the risk of exploitation.
• Monitor for Suspicious Activity: Organizations should monitor their systems for any suspicious activity that may indicate exploitation of this vulnerability.
• Implement Web Application Firewall (WAF): A WAF can help to block malicious requests that attempt to exploit this vulnerability.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.