REDHAT-BUG-2253952: Medium severity Keycloak Keycloak vulnerability

Published Dec 11, 2023

Updated

Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL (ACS), including JavaScript URIs (javascript:). Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission. Thus, Keycloak is vulnerable to Cross-Site Scripting (XXS) by registering a JavaScript URI as Assertion Consumer Service POST Binding URL.

Affected Software

1 affected component

Keycloak Keycloak

Event History

Dec 11, 2023

Data Sourced

via Red Hat·08:34 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2253952?

The severity of REDHAT-BUG-2253952 is critical due to the potential for arbitrary JavaScript execution.

How do I fix REDHAT-BUG-2253952?

To fix REDHAT-BUG-2253952, update Keycloak to the latest version that addresses this vulnerability.

What types of systems are affected by REDHAT-BUG-2253952?

Systems running affected versions of Keycloak are vulnerable to REDHAT-BUG-2253952.

What is the risk of exploiting REDHAT-BUG-2253952?

Exploiting REDHAT-BUG-2253952 can lead to XSS attacks by executing malicious scripts in the context of user sessions.

Is REDHAT-BUG-2253952 a known vulnerability?

Yes, REDHAT-BUG-2253952 is a known vulnerability documented in the Red Hat bug tracking system.