CVE-2022-0225: XSS
A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
Other sources
The ”Groups” dropdown in ”Add user” is not escaped properly and can be exploited.
Steps to reproduce
Start a vanilla keycloak (or an existing one): docker run -p 8080:8080 -e KEYCLOAKUSER=admin -e KEYCLOAKPASSWORD=admin quay.io/keycloak/keycloak:16.1.0 Login and go to Groups. Click New to add a new group. Add a group using the payload below:
"><img src=x onerror=prompt(location)>
Go to Users and click Add user. Click Groups and enter a character, as o, to display the group. This will trigger our prompt from the group name.
Maybe also other places has this issue? This is probably an easy fix for you, but in case you want me to look into it I can do it. I’m jxn0 on github.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-0225?
CVE-2022-0225 is a vulnerability found in Keycloak that allows a privileged attacker to use a malicious payload as the group name, leading to a stored Cross-site scripting (XSS) attack.
What is the severity of CVE-2022-0225?
CVE-2022-0225 has a severity rating of 5.7, which is considered medium.
Which versions of Keycloak are affected by CVE-2022-0225?
CVE-2022-0225 affects versions 0:15.0.8-1.redhat_00001.1.el7, 0:15.0.8-1.redhat_00001.1.el8, 0:18.0.3-1.redhat_00001.1.el7, 0:18.0.3-1.redhat_00001.1.el8, and 0:18.0.3-1.redhat_00001.1.el9.
How can the vulnerability be fixed?
To fix the vulnerability, update Keycloak to version 0:18.0.3-1.redhat_00001.1.el9 or apply the appropriate remedy provided by Redhat.
What is the Common Weakness Enumeration (CWE) associated with CVE-2022-0225?
CVE-2022-0225 is associated with CWE-79, which is a category for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').