cve-2024-11736
Vulnerability from cvelistv5
Published
2025-01-14 08:36
Modified
2025-03-19 14:52
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Summary
A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.
References
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2025:0299
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2025:0300
secalert@redhat.comhttps://access.redhat.com/security/cve/CVE-2024-11736
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2328850
Impacted products
Vendor Product Version
Version: 0   ≤
Create a notification for this product.
   Red Hat Red Hat build of Keycloak 26.0 Unaffected: 26.0.8-1   < *
    cpe:/a:redhat:build_keycloak:26.0::el9
 Create a notification for this product.
   Red Hat Red Hat build of Keycloak 26.0 Unaffected: 26.0-7   < *
    cpe:/a:redhat:build_keycloak:26.0::el9
 Create a notification for this product.
   Red Hat Red Hat build of Keycloak 26.0 Unaffected: 26.0-8   < *
    cpe:/a:redhat:build_keycloak:26.0::el9
 Create a notification for this product.
   Red Hat RHBK 26.0.8     cpe:/a:redhat:build_keycloak:26.0
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-11736",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-14T14:44:22.849777Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-14T14:44:36.417Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://github.com/keycloak/keycloak",
               defaultStatus: "unaffected",
               packageName: "keycloak",
               versions: [
                  {
                     lessThan: "26.0.8",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:26.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-operator-bundle",
               product: "Red Hat build of Keycloak 26.0",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "26.0.8-1",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:26.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-rhel9",
               product: "Red Hat build of Keycloak 26.0",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "26.0-7",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://catalog.redhat.com/software/containers/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:26.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "rhbk/keycloak-rhel9-operator",
               product: "Red Hat build of Keycloak 26.0",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "26.0-8",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:26.0",
               ],
               defaultStatus: "unaffected",
               packageName: "org.keycloak/keycloak-quarkus-server",
               product: "RHBK 26.0.8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8",
               ],
               defaultStatus: "unaffected",
               packageName: "org.keycloak/keycloak-quarkus-server",
               product: "Red Hat JBoss Enterprise Application Platform 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jbosseapxp",
               ],
               defaultStatus: "unaffected",
               packageName: "org.keycloak/keycloak-quarkus-server",
               product: "Red Hat JBoss Enterprise Application Platform Expansion Pack",
               vendor: "Red Hat",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "This issue was discovered by Steven Hawkins (Red Hat).",
            },
         ],
         datePublic: "2025-01-13T13:24:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-526",
                     description: "Cleartext Storage of Sensitive Information in an Environment Variable",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-19T14:52:27.254Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2025:0299",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:0299",
            },
            {
               name: "RHSA-2025:0300",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2025:0300",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2024-11736",
            },
            {
               name: "RHBZ#2328850",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2328850",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2024-11-26T04:20:40.657000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2025-01-13T13:24:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables",
         workarounds: [
            {
               lang: "en",
               value: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
            },
         ],
         x_redhatCweChain: "CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2024-11736",
      datePublished: "2025-01-14T08:36:08.583Z",
      dateReserved: "2024-11-26T04:36:51.824Z",
      dateUpdated: "2025-03-19T14:52:27.254Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      fkie_nvd: {
         descriptions: "[{\"lang\": \"en\", \"value\": \"A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.\"}, {\"lang\": \"es\", \"value\": \"Se encontr\\u00f3 una vulnerabilidad en Keycloak. Los usuarios administradores pueden tener que acceder a variables de entorno de servidor confidenciales y propiedades del sistema a trav\\u00e9s de URL configurables por el usuario. Al configurar las URL de cierre de sesi\\u00f3n de backchannel o las URL de administrador, los usuarios administradores pueden incluir marcadores de posici\\u00f3n como ${env.VARNAME} o ${PROPNAME}. El servidor reemplaza estos marcadores de posici\\u00f3n con los valores reales de las variables de entorno o las propiedades del sistema durante el procesamiento de URL.\"}]",
         id: "CVE-2024-11736",
         lastModified: "2025-01-14T09:15:20.750",
         metrics: "{\"cvssMetricV31\": [{\"source\": \"secalert@redhat.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 4.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 3.6}]}",
         published: "2025-01-14T09:15:20.750",
         references: "[{\"url\": \"https://access.redhat.com/errata/RHSA-2025:0299\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:0300\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2024-11736\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2328850\", \"source\": \"secalert@redhat.com\"}]",
         sourceIdentifier: "secalert@redhat.com",
         vulnStatus: "Received",
         weaknesses: "[{\"source\": \"secalert@redhat.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-526\"}]}]",
      },
      nvd: "{\"cve\":{\"id\":\"CVE-2024-11736\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2025-01-14T09:15:20.750\",\"lastModified\":\"2025-01-14T09:15:20.750\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.\"},{\"lang\":\"es\",\"value\":\"Se encontró una vulnerabilidad en Keycloak. Los usuarios administradores pueden tener que acceder a variables de entorno de servidor confidenciales y propiedades del sistema a través de URL configurables por el usuario. Al configurar las URL de cierre de sesión de backchannel o las URL de administrador, los usuarios administradores pueden incluir marcadores de posición como ${env.VARNAME} o ${PROPNAME}. El servidor reemplaza estos marcadores de posición con los valores reales de las variables de entorno o las propiedades del sistema durante el procesamiento de URL.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-526\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2025:0299\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2025:0300\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2024-11736\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2328850\",\"source\":\"secalert@redhat.com\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-11736\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-14T14:44:22.849777Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-14T14:44:31.729Z\"}}], \"cna\": {\"title\": \"Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables\", \"credits\": [{\"lang\": \"en\", \"value\": \"This issue was discovered by Steven Hawkins (Red Hat).\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.0.8\", \"versionType\": \"semver\"}], \"packageName\": \"keycloak\", \"collectionURL\": \"https://github.com/keycloak/keycloak\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.0.8-1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-operator-bundle\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.0-7\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.0-8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.0\"], \"vendor\": \"Red Hat\", \"product\": \"RHBK 26.0.8\", \"packageName\": \"org.keycloak/keycloak-quarkus-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8\", \"packageName\": \"org.keycloak/keycloak-quarkus-server\", \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"org.keycloak/keycloak-quarkus-server\", \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-11-26T04:20:40.657000+00:00\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2025-01-13T13:24:00+00:00\", \"value\": \"Made public.\"}], \"datePublic\": \"2025-01-13T13:24:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2025:0299\", \"name\": \"RHSA-2025:0299\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2025:0300\", \"name\": \"RHSA-2025:0300\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2024-11736\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2328850\", \"name\": \"RHBZ#2328850\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-526\", \"description\": \"Cleartext Storage of Sensitive Information in an Environment Variable\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2025-03-19T14:52:27.254Z\"}, \"x_redhatCweChain\": \"CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable\"}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-11736\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-19T14:52:27.254Z\", \"dateReserved\": \"2024-11-26T04:36:51.824Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2025-01-14T08:36:08.583Z\", \"assignerShortName\": \"redhat\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.