Improper Verification of Cryptographic Signature Affecting org.keycloak:keycloak-saml-core package, versions [,22.0.13) [23.0.0,24.0.8) [25.0.0,25.0.6)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGKEYCLOAK-8061829
- published 20 Sep 2024
- disclosed 19 Sep 2024
- credit Tanner Emek
Introduced: 19 Sep 2024
CVE-2024-8698 Open this link in a new tabHow to fix?
Upgrade org.keycloak:keycloak-saml-core to version 22.0.13, 24.0.8, 25.0.6 or higher.
Overview
org.keycloak:keycloak-saml-core is an Identity and Access Management plugin for Keycloak.
Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature improper validation logic in the signature validation method, which relies on the position of signatures rather than explicitly checking the referenced elements. An attacker can escalate privileges or impersonate another user by crafting responses that bypass the signature validation. This facilitates unauthorized access to high-privileged accounts in SAML-based identity providers and service providers.