CVE-2024-7341
Public on
Last Modified:
Description
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
Statement
This vulnerability is categorized as moderate severity rather than critical due to its specific exploitation conditions and impact. While it presents a session fixation risk, the attacker must first hijack a session before authentication. This pre-condition limits the exploitation vector to scenarios where an attacker has already gained some level of access or control. Additionally, the attack only impacts sessions where the turnOffChangeSessionIdOnLogin option is not set to true. Consequently, while it does pose a risk by potentially allowing unauthorized access if the session ID is not updated, the overall likelihood and impact of successful exploitation are mitigated by these constraints.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Additional information
- Bugzilla 2302064: wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
- CWE-384: Session Fixation
- FAQ: Frequently asked questions about CVE-2024-7341
Common Vulnerability Scoring System (CVSS) Score Details
Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
| Red Hat | NVD | |
|---|---|---|
CVSS v3 Base Score | 7.1 | 7.1 |
Attack Vector | Network | Network |
Attack Complexity | High | High |
Privileges Required | Low | Low |
User Interaction | Required | Required |
Scope | Unchanged | Unchanged |
Confidentiality Impact | High | High |
Integrity Impact | High | High |
Availability Impact | High | High |
CVSS v3 Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Frequently Asked Questions
Why is Red Hat's CVSS v3 score or Impact different from other vendors?
For more information, see https://access.redhat.com/solutions/762393.
My product is listed as "Under investigation" or "Affected", when will Red Hat release a fix for this vulnerability?
- "Under investigation" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.
- The term "Affected" means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.
What can I do if my product is listed as "Will not fix"?
Available options depend mostly on the Impact of the vulnerability and the current Life Cycle phase of your product. Overall, you have the following options:
- Upgrade to a supported product version that includes a fix for this vulnerability (recommended).
- Apply a mitigation (if one exists).
- Open a support case to request a prioritization of releasing a fix for this vulnerability.
What can I do if my product is listed as "Fix deferred"?
Available options depend mostly on the Impact of the vulnerability and the current Life Cycle phase of your product. Overall, you have the following options:
- Apply a mitigation (if one exists).
- Open a support case to request a prioritization of releasing a fix for this vulnerability.
- Red Hat Engineering focuses on addressing high-priority issues based on their complexity or limited lifecycle support. Therefore, lower-priority issues will not receive immediate fixes.
What is a mitigation?
I have a Red Hat product but it is not in the above list, is it affected?
Why is my security scanner reporting my product as vulnerable to this vulnerability even though my product version is fixed or not affected?
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
