REDHAT-BUG-2433727: SSRF
Blind SSRF behavior in the CIBA implementation of Keycloak. The issue arises because the backchannelclientnotificationendpoint configured during Dynamic Client Registration or client administration is not sufficiently validated before use. An attacker with high privileges (Administrator access or a valid Initial Access Token) can configure this endpoint to point to arbitrary internal URLs, including localhost or cloud metadata services. When a CIBA authentication request is initiated in ping mode, Keycloak sends a blind POST request to the configured endpoint. While the attacker cannot observe the response, the behavior allows limited influence over server-side network interactions and may enable abuse of internal services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2433727?
The severity of REDHAT-BUG-2433727 is high due to the potential for an attacker to exploit blind SSRF behavior.
How do I fix REDHAT-BUG-2433727?
To fix REDHAT-BUG-2433727, ensure that the backchannel_client_notification_endpoint is properly validated before use.
What is the cause of REDHAT-BUG-2433727?
REDHAT-BUG-2433727 is caused by insufficient validation of the backchannel_client_notification_endpoint during Dynamic Client Registration.
Who is affected by REDHAT-BUG-2433727?
REDHAT-BUG-2433727 affects users of Red Hat Keycloak with high privileges, particularly those with Administrator access.
What are the risks associated with REDHAT-BUG-2433727?
The risks associated with REDHAT-BUG-2433727 include the possibility of unauthorized access and exploitation of the system through SSRF.