Vulnerability feed

Executive summary

Apache Camel's Keycloak component can keep accepting an access token for a short time after it has expired when token introspection is enabled and results are cached. The advisory rates the issue medium and says it grants no token forgery or privilege escalation, since the attacker can only reuse privileges the expired token already carried. Users should upgrade to a fixed release (4.23.0, or 4.22.2, 4.18.5 on their respective streams), or disable introspection caching as an interim step.

Technical summary

This is an insufficient session expiration flaw (cached token introspection responses are not bounded by the token's exp claim) in the camel-keycloak KeycloakSecurityPolicy when useTokenIntrospection=true. Both ConcurrentMapTokenCache and CaffeineTokenCache expire entries after a fixed time rather than at exp, and KeycloakSecurityProcessor checks only the active flag, so a cached response can be reused for up to introspectionCacheTtl after expiry (60 seconds by default). Preconditions are that introspection is enabled, the same process introspected the token while it was active, and the attacker holds that token, which is typically sent as a bearer token. Affected versions are from 4.16.0 before 4.18.5 and from 4.19.0 before 4.22.2; fixed versions are 4.23.0, 4.22.2 and 4.18.5 by release stream, and 4.16.x, 4.17.x and 4.19.x to 4.21.x are end of life with no fix. Workaround: set introspectionCacheEnabled=false, which the advisory says makes every request check the endpoint. Lowering introspectionCacheTtl is stated not to close the window. No detection guidance, exploitation status, or CVSS score is stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affects

ApacheApache CamelApache Camel Keycloak component