GitHub Advisoryadvisory · Maven

GHSA-8rmm-gm28-pj8q Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow

MEDIUM Published 2024-04-17 Modified 2024-08-29 Official page ↗
Aliases
CVE-2023-6717
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Weaknesses
CWE-20, CWE-601, CWE-79
Reviewed
2024-04-17

Affected packages

• Maven org.keycloak:keycloak-services: < 22.0.10 → fixed in 22.0.10 • Maven org.keycloak:keycloak-services: >= 23.0.0, < 24.0.3 → fixed in 24.0.3

Description

Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL (ACS), including JavaScript URIs (javascript:). Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission. Acknowledgements: Special thanks to Lauritz Holtmann for reporting this issue and helping us improve our project.

Related

Alias · CVE (1)

  • CVE-2023-6717 A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as… vulnerability

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-601 URL Redirection to Untrusted Site weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References