CVE-2022-3782: Keycloak Path Traversal Vulnerability

CVE-2022-3782 Overview

A path traversal vulnerability exists in Red Hat Keycloak due to improper validation of URLs included in redirects. The flaw allows attackers to bypass validation through double URL encoding, potentially enabling access to other URLs and sensitive information within the domain. This vulnerability affects any client configuration that utilizes wildcard characters in the Valid Redirect URIs field, creating significant exposure for organizations relying on Keycloak for identity and access management.

Critical Impact

Attackers can exploit this path traversal vulnerability to bypass URL validation, access sensitive information, and potentially conduct further attacks against Keycloak-protected resources.

Affected Products

• Red Hat Keycloak 20.0.2
• Red Hat Keycloak versions with wildcard configurations in Valid Redirect URIs

Discovery Timeline

• 2023-01-13 - CVE-2022-3782 published to NVD
• 2025-04-09 - Last updated in NVD database

Technical Details for CVE-2022-3782

Vulnerability Analysis

This vulnerability stems from insufficient URL validation within Keycloak's redirect handling mechanism. When processing redirect URLs, Keycloak fails to properly decode and validate double-encoded URL sequences, allowing attackers to craft malicious requests that bypass the intended security controls.

The flaw is particularly dangerous in configurations where administrators have configured Valid Redirect URIs using wildcard patterns. Wildcard configurations are commonly used to simplify redirect URI management across multiple subdomains or paths, but this convenience creates an attack surface when combined with the double URL encoding bypass.

The attack can be executed remotely without authentication and requires no user interaction, making it highly exploitable in internet-facing Keycloak deployments. Successful exploitation allows attackers to redirect users to arbitrary URLs within the same domain, potentially leading to credential theft, phishing attacks, or access to internal resources.

Root Cause

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. Keycloak's URL validation logic does not account for double URL encoding scenarios, where path traversal sequences like ../ are encoded twice (e.g., %252e%252e%252f). The first decoding pass produces a still-encoded string that passes validation, while subsequent processing decodes it again, revealing the malicious path traversal sequence.

Attack Vector

The attack is network-based and can be executed by crafting a specially designed redirect URL that appears legitimate after initial validation but resolves to an unauthorized path after full decoding. An attacker would construct a URL containing double-encoded path traversal sequences and submit it through Keycloak's OAuth/OIDC authentication flow.

The attack exploits the redirect validation during authorization code or token requests, where Keycloak compares the provided redirect URI against the configured Valid Redirect URIs. By using double encoding, the attacker bypasses the wildcard pattern matching, allowing redirection to unintended destinations within the application's domain structure.

Detection Methods for CVE-2022-3782

Indicators of Compromise

• Unusual redirect URLs containing encoded sequences like %252e, %252f, or %2e%2e%2f in Keycloak access logs
• Authentication requests with abnormally long or complex redirect_uri parameters
• Multiple failed or suspicious redirect attempts from the same source IP targeting OAuth endpoints
• Access to unexpected paths or resources following authentication flows

Detection Strategies

• Monitor Keycloak access logs for requests containing double-encoded characters in the redirect_uri parameter
• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns including URL-encoded variants
• Configure alerting for OAuth/OIDC authentication flows with redirect URIs that differ significantly from expected patterns
• Enable detailed logging on Keycloak authentication events to capture full request parameters

Monitoring Recommendations

• Audit Valid Redirect URI configurations across all Keycloak clients for wildcard usage
• Implement real-time log analysis for path traversal indicators in authentication endpoints
• Review Keycloak audit logs periodically for anomalous redirect patterns
• Deploy endpoint monitoring to track authentication flow anomalies

How to Mitigate CVE-2022-3782

Immediate Actions Required

• Review and update all Keycloak client configurations to remove or restrict wildcard usage in Valid Redirect URIs
• Apply the latest Keycloak security patches that address double URL encoding validation
• Implement WAF rules to block requests containing encoded path traversal sequences
• Audit existing redirect URI configurations and replace wildcards with explicit, fully-qualified URIs where possible

Patch Information

Red Hat has released security updates addressing this vulnerability. Administrators should consult the Red Hat CVE-2022-3782 Advisory for specific patch versions and upgrade instructions. Upgrade to a patched version of Keycloak as the primary remediation strategy.

Workarounds

• Remove wildcard characters from Valid Redirect URIs configurations and use explicit, fully-qualified redirect URIs instead
• Implement network-level filtering to detect and block requests containing double-encoded path traversal sequences
• Deploy a reverse proxy or WAF with URL normalization capabilities to decode URLs before they reach Keycloak
• Restrict access to Keycloak administration interfaces and OAuth endpoints to trusted networks where feasible

# Review Keycloak client redirect URI configurations
# Example: Audit clients using Keycloak Admin CLI
kcadm.sh get clients -r your-realm --fields id,clientId,redirectUris | grep -E "\*|%"

# Replace wildcard URIs with explicit paths in client configuration
# Before: https://example.com/*
# After:  https://example.com/callback, https://example.com/auth/callback