Keycloak: xss via assertion consumer service url in saml post-binding flow

CVE-2023-6717

What is CVE-2023-6717?

A vulnerability exists within the SAML client registration feature of Keycloak that can enable a malicious administrator to register harmful JavaScript URIs as Assertion Consumer Service POST Binding URLs. This presents a Cross-Site Scripting (XSS) threat, where an attacker with administrative privileges in one realm or client with registration access can target users across different realms or applications. Upon form submission, the execution of arbitrary JavaScript in the user’s context can occur, potentially leading to unauthorized access and harmful actions, which jeopardizes the confidentiality, integrity, and availability of the entire Keycloak instance.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References