REDHAT-BUG-2398025: Low severity Keycloak Keycloak vulnerability
The keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy (see https://www.keycloak.org/server/reverseproxy#exposedpathrecommendations ). The problem is that, at least ha-proxy, can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms (which should be exposed). For example:
curl --path-as-is http://localhost:7080/realms/../admin/master/console/#/master/info <http://localhost:7080/admin/master/console/#/master/info>
The admin path requires authentication but, in the end, the final customer is exposing a path that he thinks is not accessible. Also note that this is more an issue in ha-proxy than keycloak. Keycloak does not even document how to configure ha-proxy or any other proxy, it just recommends to not expose the /admin app. For example mod-proxy correctly manages non-normalized URLs, because it normalizes the path before to be sure it's inside the prefix-path.
Nevertheless we have reached the conclusion that keycloak should return an error by default for non-normalized URLs.
The installation should use a proxy configuration with ha-proxy with the common configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update Keycloak so that requests using relative/non-normalized URL paths (e.g., /realms/../admin/...) are rejected with an error by default.
Keycloak behavior_for_non-normalized_URLs (relative/non-normalized paths) = return an error by default - Configuration
Configure the reverse proxy and Keycloak exposure so that the /admin application path is not exposed to external clients when using a proxy, per the Keycloak exposed path recommendations.
Keycloak reverse-proxy guidance exposed_path (do not expose /admin) = do not expose /admin path to the outside - Compensating control
Harden the reverse proxy (notably HAProxy) to prevent traversal/aliasing via relative or non-normalized paths that can trick routing to /admin (example: /realms/../admin/... under a realms prefix). Ensure the proxy performs path normalization/handling that stops such requests from reaching the Keycloak /admin endpoints.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2398025?
The severity of REDHAT-BUG-2398025 is significant due to potential unauthorized access to the Keycloak admin features.
How do I fix REDHAT-BUG-2398025?
To fix REDHAT-BUG-2398025, ensure that the /admin path is not exposed to the public when using a reverse proxy.
Which software is affected by REDHAT-BUG-2398025?
REDHAT-BUG-2398025 affects Keycloak and HAProxy installations.
What are the risks associated with REDHAT-BUG-2398025?
The risks associated with REDHAT-BUG-2398025 include the potential for attackers to access administrative features and sensitive data.
Is REDHAT-BUG-2398025 a known vulnerability in the community?
Yes, REDHAT-BUG-2398025 is a recognized vulnerability that is being documented and discussed in the security community.