Keycloak-services: Denial of Service via Regex Complexity in SearchQueryUtils
CVE-2024-10270 Published on November 25, 2024

Org.keycloak:keycloak-services: keycloak denial of service
A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

Github Repository Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2024-10270 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 29 days later.

Weakness Type

What is a ReDoS Vulnerability?

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match. Backtracking becomes a weakness if all of these conditions are met:

CVE-2024-10270 has been classified to as a ReDoS vulnerability or weakness.


Products Associated with CVE-2024-10270

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-10270 are published in these products:

Red Hat Keycloak
 
Red Hat Build Keycloak
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Single Sign On
 

Vulnerable Packages

The following package name and versions may be associated with CVE-2024-10270

Package Manager Vulnerable Package Versions Fixed In
maven org.keycloak:keycloak-services < 24.0.9 24.0.9
maven org.keycloak:keycloak-services >= 25.0.0, < 26.0.6 26.0.6

Exploit Probability

EPSS
0.09%
Percentile
25.14%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.