Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS13MzU0LTJmM2MtcXZnOc4AAx5J
Keycloak vulnerable to Cross-site Scripting
A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.
Details
This issue is the result of code found in the exception here: https://github.com/keycloak/keycloak/blob/48835576daa158443f69917ac309e1a7c951bc87/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java#L1045
Steps to reproduce
When using the legacy admin console:
- Sign in as Admin user in first tab.
- In that tab create new user in keycloak admin section > intercept user creation request and modify it by including malicious js script there (in username field).
- Sign in as newly created user in second tab (same browser window but second tab).
- Navigate back to first tab where you are signed in as admin, navigate to admin console which lists all application users.
- Choose any user (except newly created malicious one) – modify anything for that user in his settings. E.g. navigate to credentials tab and set new credentials for him. Also set new password as temporary.
- After update for that user is made, use impersonate option on that modified user.
- You should see window with form which requires providing new credentials – fill it and submit request.
- Just after submiting request user will get notified that “You are already authenticated as different user ‘[user + payload]’ in this session. Please sign out first.” And malicious payload will be executed instantly.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13MzU0LTJmM2MtcXZnOc4AAx5J
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: 6 months ago
CVSS Score: 6.4
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Identifiers: GHSA-w354-2f3c-qvg9, CVE-2022-1438
References:
- https://github.com/keycloak/keycloak/security/advisories/GHSA-w354-2f3c-qvg9
- https://access.redhat.com/security/cve/cve-2022-1438
- https://bugzilla.redhat.com/show_bug.cgi?id=2031904
- https://github.com/keycloak/keycloak/blob/48835576daa158443f69917ac309e1a7c951bc87/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java#L1045
- https://nvd.nist.gov/vuln/detail/CVE-2022-1438
- https://access.redhat.com/errata/RHSA-2023:1043
- https://access.redhat.com/errata/RHSA-2023:1044
- https://access.redhat.com/errata/RHSA-2023:1045
- https://access.redhat.com/errata/RHSA-2023:1047
- https://access.redhat.com/errata/RHSA-2023:1049
- https://github.com/advisories/GHSA-w354-2f3c-qvg9
Blast Radius: 17.6
Affected Packages
maven:org.keycloak:keycloak-services
Dependent packages: 90Dependent repositories: 561
Downloads:
Affected Version Ranges: <= 21.0.0
No known fixed version
All affected versions: 5.0.0, 6.0.0, 6.0.1, 7.0.0, 7.0.1, 8.0.0, 8.0.1, 8.0.2, 9.0.0, 9.0.2, 9.0.3, 10.0.0, 10.0.1, 10.0.2, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 13.0.0, 13.0.1, 14.0.0, 15.0.0, 15.0.1, 15.0.2, 15.1.0, 15.1.1, 16.0.0, 16.1.0, 16.1.1, 17.0.0, 17.0.1, 18.0.0, 18.0.1, 18.0.2, 19.0.0, 19.0.1, 19.0.2, 19.0.3, 20.0.0, 20.0.1, 20.0.2, 20.0.3, 20.0.4, 20.0.5, 21.0.0