CVE-2023-6717
Keycloak: xss via assertion consumer service url in saml post-binding flow
MEDIUM 6.0
At a glance
- Source
- NVD
- EPSS
- EPSS 0.71 % · percentile 53 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Deferred
Description
A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.
Weaknesses (CWE)
- CWE-79 — Cross-site Scripting (XSS)
References
- https://access.redhat.com/errata/RHSA-2024:1353
- https://access.redhat.com/errata/RHSA-2024:1867
- https://access.redhat.com/errata/RHSA-2024:1868
- https://access.redhat.com/errata/RHSA-2024:2945
- https://access.redhat.com/errata/RHSA-2024:4057
- https://access.redhat.com/security/cve/CVE-2023-6717
- https://bugzilla.redhat.com/show_bug.cgi?id=2253952
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L | redhat |
| CVSS 3.1 | MEDIUM 6.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L | NVD · secalert@redhat.com (Secondary) |
Advisories
- GHSA-8rmm-gm28-pj8q — Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow
European references
- ENISA EUVD · EUVD-2024-1164
- GCVE · GCVE-0-2023-6717
Affected products
| Product | Versions |
|---|---|
| keycloak | affected 0 < 22.0.10 ; affected 24.0.0 < 24.0.3 |
| Red Hat · Red Hat AMQ Broker 7 | |
| Red Hat · Red Hat build of Keycloak 22 | unaffected 22.0.10-1 < * |
| Red Hat · Red Hat build of Keycloak 22 | unaffected 22-13 < * |
| Red Hat · Red Hat build of Keycloak 22 | unaffected 22-16 < * |
| Red Hat · Red Hat build of Keycloak 22.0.10 | |
| Red Hat · RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 < * |
| Red Hat · RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 < * |
| Red Hat · RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 < * |
| Red Hat · RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 < * |
| Red Hat · RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 < * |
| Red Hat · RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 < * |
| Red Hat · RHOSS-1.33-RHEL-8 | unaffected 1.33.0-3 < * |
| Red Hat · RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 < * |
| Red Hat · RHOSS-1.33-RHEL-8 | unaffected 1.33.0-5 < * |
| Red Hat · RHPAM 7.13.5 async | |
| Red Hat · Migration Toolkit for Applications 6 | |
| Red Hat · Migration Toolkit for Applications 7 | |
| Red Hat · Red Hat build of Apicurio Registry 2 | |
| Red Hat · Red Hat build of Quarkus |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |