CVE-2024-1249: Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS
A potential security flaw in the “checkLoginIframe” which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application’s availability without proper origin validation for incoming messages.
References
- access.redhat.com/errata/RHSA-2024:1860
- access.redhat.com/errata/RHSA-2024:1861
- access.redhat.com/errata/RHSA-2024:1862
- access.redhat.com/errata/RHSA-2024:1864
- access.redhat.com/errata/RHSA-2024:1866
- access.redhat.com/errata/RHSA-2024:1867
- access.redhat.com/errata/RHSA-2024:1868
- access.redhat.com/security/cve/CVE-2024-1249
- bugzilla.redhat.com/show_bug.cgi?id=2262918
- github.com/advisories/GHSA-m6q9-p373-g5q8
- github.com/keycloak/keycloak
- github.com/keycloak/keycloak/security/advisories/GHSA-m6q9-p373-g5q8
- nvd.nist.gov/vuln/detail/CVE-2024-1249
Code Behaviors & Features
Detect and mitigate CVE-2024-1249 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →