(CVE-2024-3656) Keycloak REST服务 输入验证漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-3656
• https://access.redhat.com/security/cve/cve-2024-3656
• https://github.com/h4x0r-dz/CVE-2024-3656
• https://bugzilla.redhat.com/show_bug.cgi?id=2274403
• https://github.com/advisories/GHSA-2cww-fgmg-4jqc
• https://www.tenable.com/plugins/nessus/200516
• https://github.com/keycloak/keycloak/discussions/30904
• https://pentest-tools.com/vulnerabilities-exploits/keycloak-2405-broken-access-control_23703
• https://securityonline.info/keycloak-patches-cve-2024-3656-granting-low-privilege-users-administrative-access/
• https://www.cve.org/CVERecord?id=CVE-2024-3656

Related Vulnerabilities

• PoCCVE-2026-18963: Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass
• PoCkeycloak-admin-console-config: Keycloak Admin Console Configuration Disclosure
• PoCCVE-2020-10770: Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)
• PoCCVE-2020-27838: KeyCloak - Information Exposure
• PoCCVE-2021-20323: Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting
• PoCCVE-2024-3656: Keycloak < 24.0.5 - Broken Access Control
• PoCCVE-2024-8698: Keycloak - SAML Core Package Signature Validation Flaw
• PoCCVE-2024-8883: Keycloak - Open Redirect
• Red Hat Keycloak 签名验证不当漏洞
• Red Hat Keycloak 信息泄露漏洞
• Keycloak <= 12.0.1存在SSRF漏洞(CVE-2020-10770)