keycloak/keycloak · Security
Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow
- GHSA ID
- GHSA-8rmm-gm28-pj8q
- CVE ID
- CVE-2023-6717
- Severity
- medium
- Published
- Updated
- CVSS
- 6 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
- CVSS v3
- 6 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Description
Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL (ACS), including JavaScript URIs (javascript:).
Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission.
Acknowledgements:
Special thanks to Lauritz Holtmann for reporting this issue and helping us improve our project.
CWEs
- CWE-20 · Improper Input Validation
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
References
- https://github.com/keycloak/keycloak/security/advisories/GHSA-8rmm-gm28-pj8q ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-6717 ↗
- https://access.redhat.com/errata/RHSA-2024:1867 ↗
- https://access.redhat.com/errata/RHSA-2024:1868 ↗
- https://access.redhat.com/security/cve/CVE-2023-6717 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2253952 ↗
- https://access.redhat.com/errata/RHSA-2024:2945 ↗
- https://access.redhat.com/errata/RHSA-2024:4057 ↗
- https://access.redhat.com/errata/RHSA-2024:1353 ↗
- https://github.com/advisories/GHSA-8rmm-gm28-pj8q ↗