Listen to this Post
The vulnerability exists within the Keycloak Admin REST API’s `/admin/realms/{realm}/roles` endpoint. Normally, this endpoint should enforce strict administrative permissions to prevent unauthorized access to sensitive role metadata. The flaw is an insufficient authorization check, where the API fails to properly validate the requesting user’s privileges for certain HTTP methods or query parameters. This allows an authenticated but non-administrative user to send crafted requests that bypass the intended permission matrix. Consequently, the API may return detailed role information, such as role names, IDs, and associated metadata, which should be restricted. The information disclosure occurs due to a missing or incorrect authorization gate within the endpoint’s request handling logic, leading to a confidentiality impact without compromising integrity or availability.
Platform: Keycloak
Version: Affected versions
Vulnerability: Authorization Bypass
Severity: Low
date: 2024-12-10
Prediction: Patch Q1 2024
What Undercode Say:
curl -H "Authorization: Bearer $USER_TOKEN" https://keycloak-host/admin/realms/master/roles Check for excessive data in response. grep -r "roles" /opt/keycloak/quarkus-app/lib/ Review application logs for access patterns.
How Exploit:
1. Attacker obtains a valid low-privilege user token.
- Attacker crafts GET request to admin roles endpoint.
3. Server processes request without sufficient privilege check.
- Sensitive role metadata is returned in the response.
Protection from this CVE
1. Apply official patch.
2. Restrict network access to Admin API.
3. Implement API gateway authorization rules.
4. Audit user assignments and permissions.
Impact: Sensitive Role Information Disclosure
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
