Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow
Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL (ACS), including JavaScript URIs (javascript:). Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission. #### Acknowledgements: Special thanks to Lauritz Holtmann for reporting this issue and helping us improve our project.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-6717US | — | — | ||
A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2024:1353WEB
- https://access.redhat.com/errata/RHSA-2024:1867WEB
- https://access.redhat.com/errata/RHSA-2024:1868WEB
- https://access.redhat.com/errata/RHSA-2024:2945WEB
- https://access.redhat.com/errata/RHSA-2024:4057WEB
- https://access.redhat.com/security/cve/CVE-2023-6717WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2253952WEB
- https://github.com/keycloak/keycloakPACKAGE
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan