CVE-2022-2668: High severity redhat keycloak vulnerability
A flaw was found in keycloak. The vulnerability allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOADSCRIPTS feature is disabled.
Other sources
An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOADSCRIPTS feature is disabled
Original report
From @mposolda
In the past we had CVE due the fact it was possible to upload javascripts directly through admin console. The ability to deploy scripts through admin console was deprecated and in Keycloak 18 (RH-SSO 7.6) removed entirely for:
Javascript authorization policy Script based authenticator OIDC protocol mapper
However it seems we have this ability still enabled for javascript based protocol mapper for SAML clients. I've checked with latest Keycloak and also with RH-SSO 7.6 and RH-SSO 7.5 that it is still possible to directly upload javascripts with the admin console with the usage of SAML javascript protocol mapper. This is possible even if SCRIPTS feature is disabled (and also UPLOADSCRIPTS in RH-SSO 7.5), which makes it even worse though... So administrator of SAML clients still has the ability to run arbitrary javascript code on the server (for example to read content of the file /etc/passwd and log it somewhere etc)
IMO this can be classified as CVE and looks like something, which should be fixed soon and backported to RH-SSO 7.6 (I guess also 7.5 z-stream, not sure about 7.4 and if we are still required to support that one as z-stream).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:15.0.8-1.redhat_00001.1.el7 - Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:15.0.8-1.redhat_00001.1.el8 - Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:18.0.3-1.redhat_00001.1.el7 - Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:18.0.3-1.redhat_00001.1.el8 - Upgrade
Upgrade
redhat/rh-sso7to a version that resolves this vulnerability.Fixed in 0:1-5.el9 - Upgrade
Upgrade
redhat/rh-sso7-javapackages-toolsto a version that resolves this vulnerability.Fixed in 0:6.0.0-7.el9 - Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 0:18.0.3-1.redhat_00001.1.el9 - Upgrade
Upgrade
redhat/keycloakto a version that resolves this vulnerability.Fixed in 19.0.2 - Configuration
Ensure the UPLOAD_SCRIPTS feature is disabled; the flaw allows arbitrary Javascript to be uploaded for the SAML protocol mapper even when UPLOAD_SCRIPTS is disabled.
Keycloak SAML protocol mapper UPLOAD_SCRIPTS feature = disabled - Compensating control
Restrict administrative access to the Keycloak admin console used to upload/define SAML OIDC protocol mappers and JavaScript-based mappers, since administrators of SAML clients still have the ability to deploy/upload JavaScript via the admin console (even when UPLOAD_SCRIPTS is disabled).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-2668?
CVE-2022-2668 is a vulnerability found in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper, even if the UPLOAD_SCRIPTS feature is disabled.
What software is affected by CVE-2022-2668?
Keycloak versions up to, but excluding, 19.0.2, rh-sso7-keycloak versions up to, but excluding, 0:15.0.8-1.redhat_00001.1.el7, rh-sso7-keycloak versions up to, but excluding, 0:15.0.8-1.redhat_00001.1.el8, rh-sso7-keycloak versions up to, but excluding, 0:18.0.3-1.redhat_00001.1.el7, rh-sso7-keycloak versions up to, but excluding, 0:18.0.3-1.redhat_00001.1.el8, rh-sso7, rh-sso7-javapackages-tools versions up to, but excluding, 0:1-5.el9, and rh-sso7-keycloak versions up to, but excluding, 0:18.0.3-1.redhat_00001.1.el9 are affected by CVE-2022-2668.
What is the severity of CVE-2022-2668?
The severity of CVE-2022-2668 is high with a CVSS score of 7.2.
How can I fix CVE-2022-2668?
To fix CVE-2022-2668, you should update your Keycloak, rh-sso7-keycloak, rh-sso7, rh-sso7-javapackages-tools to versions 19.0.2, 0:15.0.8-1.redhat_00001.1.el7, 0:15.0.8-1.redhat_00001.1.el8, 0:18.0.3-1.redhat_00001.1.el7, 0:18.0.3-1.redhat_00001.1.el8, 0:1-5.el9, and 0:18.0.3-1.redhat_00001.1.el9 respectively, which have the necessary remediation for this vulnerability.
What is the Common Weakness Enumeration (CWE) of CVE-2022-2668?
The Common Weakness Enumeration (CWE) of CVE-2022-2668 is CWE-440.