Privilege Escalation Affecting org.keycloak:keycloak-services package, versions [,3.3.0.Final)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGKEYCLOAK-31564
- published 5 Nov 2017
- disclosed 15 Oct 2017
- credit Bart Toersche
Introduced: 15 Oct 2017
CVE-2017-12160 Open this link in a new tabHow to fix?
Upgrade org.keycloak:keycloak-services to version 3.3.0.Final or higher.
Overview
org.keycloak:keycloak-services is an open Source Identity and Access Management for modern Applications and Services.
Affected versions of the package are vulnerable to Privilege Escalation. It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks