CVE-2020-1697: XSS
A flaw was found during the assessment of the Admin Console application for Keycloak, where it was found that Application Links to external applications are not validated properly. An attacker could use this flaw to cause Stored XSS attacks.
Other sources
During the assessment of the Admin Console application, it was found that links to external applications, so called Application Links, does not get validated properly and therefore are prone to Stored XSS attacks. The affected parameter BaseURL within the Clients settings page from the admin console application accepts any characters and therefore it is possible to insert URLs with the javascript
https://issues.redhat.com/browse/KEYCLOAK-12459
— Red Hat
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/keycloakto a version that resolves this vulnerability.Fixed in 9.0.0 - Upgrade
Upgrade
keycloakto a version that resolves this vulnerability.Fixed in 9.0.0 - Configuration
Ensure the BaseURL field used for Application Links is validated and sanitized so injected JavaScript cannot be stored and later rendered as Stored XSS.
Keycloak Admin Console (Clients settings page) BaseURL = validated/escaped to prevent insertion of JavaScript (e.g., do not allow javascript: URLs or special characters that lead to script injection)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-1697?
CVE-2020-1697 is a vulnerability found in all versions of Keycloak before 9.0.0 that allows for Stored XSS attacks through improperly validated links to external applications in the admin console.
What is the severity of CVE-2020-1697?
The severity of CVE-2020-1697 is medium, with a CVSSv3 base score of 6.1.
Which software versions are affected by CVE-2020-1697?
All versions of Keycloak before 9.0.0 are affected by CVE-2020-1697.
How can an attacker exploit CVE-2020-1697?
An authenticated malicious user can create URLs to trick users in other realms and potentially conduct further attacks by exploiting CVE-2020-1697.
What is the recommended solution for CVE-2020-1697?
The recommended solution is to update Keycloak to version 9.0.0 or later.