REDHAT-BUG-2480170: XSS
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
Affected Software
Event History
Frequently Asked Questions
Which users or access paths present the primary exploitation risk?
Exploitation requires administrative privileges that include the manage-client permission, or access to client registration endpoints. An unauthenticated external attacker is not described as having the ability to register the malicious client.
What user interaction is needed for the XSS to execute?
A victim must click a crafted link associated with the malicious client's redirect URI. The described attack can be triggered through flows such as logout or the Admin Console.
What is the impact if the attack succeeds?
Successful exploitation allows arbitrary code execution in the Keycloak origin. This means the injected script executes in the security context of the Keycloak deployment rather than solely on an attacker-controlled site.