GHSA-c25h-c27q-5qpv Keycloak leaks configured LDAP bind credentials through the Keycloak admin console

• Maven org.keycloak:keycloak-ldap-federation: >= 25.0.0, < 25.0.1 → fixed in 25.0.1 • Maven org.keycloak:keycloak-ldap-federation: < 22.0.12 → fixed in 22.0.12 • Maven org.keycloak:keycloak-ldap-federation: >= 23.0.0, < 24.0.6 → fixed in 24.0.6

Impact The LDAP testing endpoint allows to change the Connection URL independently of and without having to re-enter the currently configured LDAP bind credentials. An attacker with admin access (permission manage-realm) can change the LDAP host URL ("Connection URL") to a machine they control. The Keycloak server will connect to the attacker's host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console/compromised a user with sufficient privileges can leak domain credentials and can now attack the domain. Acknowledgements Special thanks to Simon Wessling for reporting this issue and helping us improve our project