REDHAT-BUG-2537168: Medium severity vulnerability
Improper Authorization in the Admin REST API group-membership endpoints (UserResource.joinGroup and the groups list in UsersResource.createUser) allows for privilege escalation. The root cause is a missing check to determine if a group confers administrative roles when a delegated administrator manages group memberships. Exploitation requires the attacker to have a delegated administrator account with the manage-users role and the existence of a pre-configured group that maps to the realm-admin role. A successful attacker can add their own account or a new account to such a group, bypassing direct role assignment restrictions. Concrete impact: The attacker gains full administrative control over the realm, allowing them to modify realm configurations, manage all users and roles, access sensitive credentials, and potentially cause a complete denial of service by deleting realm resources.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to privilege escalation?
Exploitation requires a delegated administrator account with the manage-users role and a pre-configured group that maps to the realm-admin role. Environments without both conditions are not exposed through the described path.
What must an attacker do to gain realm-admin privileges?
The attacker uses the Admin REST API group-membership functionality to add their own account, or a newly created account, to a group that grants the realm-admin role. This bypasses restrictions on direct role assignment.
How can administrators assess whether this configuration is at risk?
Review delegated administrator accounts for the manage-users role, then identify groups mapped to the realm-admin role. A delegated administrator who can manage memberships for such a group represents the described escalation path.
What is the potential impact after successful exploitation?
An attacker gains full administrative control of the realm. They can alter realm configuration, manage users and roles, access sensitive credentials, and potentially delete realm resources, causing denial of service.