CVE-2023-6717 Keycloak: xss via assertion consumer service url in saml post-binding flow
Description
A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:LExploitable remotely over the network, with an administrator account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- High
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat AMQ Broker 7 | Versions not published | |
| Red Hat build of Keycloak 22 22 | earliest → < 22-16 | 22-16 |
| Red Hat build of Keycloak 22.0.10 | Versions not published | |
| RHOSS-1.33-RHEL-8 1.33 | earliest → < 1.33.0-5 | 1.33.0-5 |
| RHPAM 7.13.5 async | Versions not published | |
| Migration Toolkit for Applications 6 | Versions not published | |
| Migration Toolkit for Applications 7 | Versions not published | |
| Red Hat build of Apicurio Registry 2 | Versions not published | |
| Red Hat build of Quarkus | Versions not published |
Show the 13 other branches Hide the 13 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Decision Manager 7 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat JBoss Data Grid 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 6 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat Process Automation 7 | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published | |
| Red Hat Developer Hub 1 | Versions not published |
References
- RHSA-2024:1353 access.redhat.com
- RHSA-2024:1867 access.redhat.com
- RHSA-2024:1868 access.redhat.com
- RHSA-2024:2945 access.redhat.com
- RHSA-2024:4057 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2253952 bugzilla.redhat.com
Timeline
- Published
- Last modified