REDHAT-BUG-2561961: Medium severity Red Hat Keycloak vulnerability
A sensitive information disclosure flaw was found in the org.keycloak.services.clientregistration component of Keycloak. The issue arises when Keycloak is configured with an active Vault provider and Dynamic Client Registration endpoints are enabled. An authenticated attacker holding a valid Registration Access Token (RAT) for a confidential client can update the client secret to a Vault reference expression, such as vault.alias. When the attacker subsequently requests the client installation configuration through the registration endpoint, Keycloak improperly resolves the Vault expression and returns the managed secret in plaintext. An attacker with knowledge of existing Vault secret aliases in the realm can exploit this to read arbitrary Vault values without possessing administrative privileges.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue applies when a Keycloak deployment has an active Vault provider and Dynamic Client Registration endpoints enabled. Exploitation also targets confidential clients for which the attacker has a valid Registration Access Token.
What does an attacker need to exploit the disclosure?
The attacker must be authenticated and possess a valid Registration Access Token for a confidential client. They also need knowledge of Vault secret aliases in the realm to retrieve arbitrary Vault values.
What information can be exposed?
An attacker can set a client secret to a Vault reference expression and then retrieve the client installation configuration through the registration endpoint. Keycloak resolves the expression and returns the managed Vault secret in plaintext.