CVE-2023-6484: 
Java vulnerability analysis and mitigation

CVE-2023-6484 is a log injection vulnerability discovered in Keycloak that affects the WebAuthn authentication mode. The vulnerability was first reported on April 25, 2024, and impacts Keycloak's logging functionality. The flaw allows an attacker to inject text strings through the authentication form when using the WebAuthn authentication mode (NVD, Red Hat CVE).

The vulnerability is classified as a log injection flaw (CWE-117: Improper Output Neutralization for Logs). It has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The technical nature of the vulnerability involves errors in the browser client during setup/authentication with 'Security Key login' (WebAuthn) where input is written into the form, sent to Keycloak, and logged without proper escaping (Red Hat CVE).

The vulnerability has a minor impact on logs integrity. If exploited, an attacker could potentially inject false entries into log files, which might hinder or misdirect log file interpretation. This could potentially be used to cover malicious activities or corrupt log file formats (Red Hat CVE).

The vulnerability is exploitable through the WebAuthn authentication form, requiring network access but no special privileges or user interaction. The attack complexity is rated as low, indicating relatively straightforward exploitation (Red Hat CVE).

Red Hat has released security updates to address this vulnerability across multiple versions of their products, including Red Hat Single Sign-On 7.6 for RHEL 7, 8, and 9, as well as Red Hat build of Keycloak 22.0.10. Users are advised to update to the patched versions available through the respective security advisories (RHSA-2024:0798, RHSA-2024:1860).