CVE-2022-1970: Keycloak Open Redirect Vulnerability

CVE-2022-1970 Overview

CVE-2022-1970 was initially reported as an open redirect vulnerability in Keycloak 18.0.0. However, this CVE has been REJECTED by the CVE authorities. The originally reported issue has been determined to be a known misconfiguration rather than a software vulnerability. The Keycloak project already provides documentation and recommendations to mitigate this type of misconfiguration.

Important Notice

This CVE has been rejected. The reported issue is a known misconfiguration with existing mitigation guidance in the official Keycloak documentation.

Affected Products

• No affected products (CVE Rejected)

Discovery Timeline

• October 19, 2022 - CVE-2022-1970 published to NVD
• May 29, 2024 - Last updated in NVD database (marked as REJECTED)

Technical Details for CVE-2022-1970

Vulnerability Analysis

This CVE was rejected because the reported behavior is not a vulnerability in the Keycloak software itself, but rather the result of improper configuration by administrators. Open redirect issues can occur in identity and access management systems like Keycloak when redirect URIs are not properly restricted. However, this is an expected behavior when the system is misconfigured, and Keycloak provides clear documentation on how to prevent such issues.

The original report referenced an open redirect scenario in Keycloak 18.0.0, but the Keycloak team determined that this falls under the category of administrator responsibility rather than a software defect.

Root Cause

The root cause of the reported issue is misconfiguration of redirect URI validation settings in Keycloak deployments. When administrators do not properly configure allowed redirect URIs for OAuth/OIDC clients, the system may allow redirects to unintended destinations. This is documented behavior that requires proper configuration to prevent.

Attack Vector

Open redirect vulnerabilities, when they exist due to misconfiguration, typically allow an attacker to craft malicious URLs that appear legitimate but redirect users to attacker-controlled sites. This can be used in phishing attacks or to steal authentication tokens. However, since this CVE is rejected, no official attack vector classification has been assigned.

The Keycloak documentation provides guidance on properly configuring redirect URIs to prevent such misconfiguration scenarios. Administrators should consult the Keycloak Server Administration Guide for proper configuration practices.

Detection Methods for CVE-2022-1970

Indicators of Compromise

• Review Keycloak client configurations for overly permissive redirect URI patterns
• Check for wildcard redirect URI configurations that could allow arbitrary redirects
• Monitor authentication logs for unusual redirect destinations

Detection Strategies

• Audit all OAuth/OIDC client configurations in Keycloak admin console
• Review redirect URI settings for each client application
• Implement logging and alerting for redirect patterns that fall outside expected domains

Monitoring Recommendations

• Enable detailed logging for authentication flows in Keycloak
• Monitor for authentication requests with unusual redirect_uri parameters
• Implement security information and event management (SIEM) rules to detect potential open redirect attempts

How to Mitigate CVE-2022-1970

Immediate Actions Required

• Review the official Keycloak documentation on open redirectors
• Audit all configured redirect URIs in your Keycloak deployment
• Remove wildcard patterns and overly permissive redirect URI configurations
• Implement strict redirect URI validation for all OAuth/OIDC clients

Patch Information

No patch is required as this CVE has been rejected. The reported issue is a configuration matter, not a software vulnerability. Administrators should follow Keycloak's official documentation for proper configuration of redirect URI validation.

Workarounds

• Configure explicit redirect URIs for each client instead of using wildcards
• Use the "Valid Redirect URIs" field in client configuration to specify exact allowed URLs
• Enable "Full Scope Allowed" only when necessary and understand its implications
• Regularly audit client configurations as part of security maintenance procedures

# Example: Reviewing Keycloak client configurations via CLI
# Use kcadm.sh to audit client redirect URIs
./kcadm.sh get clients -r your-realm --fields clientId,redirectUris