GMS-2022-8407: Keycloak vulnerable to path traversal via double URL encoding

December 13, 2022

Keycloak does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain, or possibly conduct further attacks.

References

github.com/advisories/GHSA-g8q8-fggx-9r3q
github.com/keycloak/keycloak/pull/15982/commits/1987c942f527b9f3bbf2a86ba71ba8ae0154ac37
github.com/keycloak/keycloak/security/advisories/GHSA-g8q8-fggx-9r3q

Code Behaviors & Features

Detect and mitigate GMS-2022-8407 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →