REDHAT-BUG-2563274: Medium severity vulnerability
A vulnerability was found in Keycloak where an Insecure Direct Object Reference (IDOR) exists in the UMA resource registration endpoint (POST /realms/{realm}/authz/protection/resourceset). When remote resource management is enabled (allowRemoteResourceManagement=true), the keycloak-services component fails to verify resource ownership when a request body contains an existing resource id. An authenticated attacker with the umaprotection role can exploit this by supplying the ID of a resource owned by another user or the resource server client. Successful exploitation allows the attacker to modify the target resource's configuration, including its name, URIs, scopes, and attributes, bypassing intended ownership restrictions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected endpoint is exposed when remote resource management is enabled with allowRemoteResourceManagement=true. Exploitation also requires an authenticated account that has the uma_protection role.
What access does an attacker need to alter another owner's resource?
The attacker must authenticate and hold the uma_protection role, then know or supply the _id of an existing resource owned by another user or by the resource server client. They can submit that ID to the UMA resource registration endpoint in a POST request.
What could an attacker change after successful exploitation?
An attacker can modify the target resource's configuration despite not owning it. This includes its name, URIs, scopes, and attributes.