Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 25.0.5, 22.0.13, 24.0.8, 25.0.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub, 1 Nuclei template
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- keycloak
fixed in 25.0.5
- Red Hat Red Hat Build of Keycloak
Version range not reported
- keycloak-saml-core
Version range not reported
- rhbk/keycloak-operator-bundle
Version range not reported
- rhbk/keycloak-rhel9
Version range not reported
- rhbk/keycloak-rhel9-operator
Version range not reported
- rhbk/keycloak-operator-bundle
Version range not reported
- rhbk/keycloak-rhel9
Version range not reported
- rhbk/keycloak-rhel9-operator
Version range not reported
- keycloak-saml-core-public
Version range not reported
- org.keycloak-keycloak-parent
Version range not reported
- eap8-activemq-artemis
Version range not reported
- eap8-activemq-artemis-native
Version range not reported
- eap8-aesh-extensions
Version range not reported
- eap8-aesh-readline
Version range not reported
- eap8-apache-commons-codec
Version range not reported
- eap8-apache-commons-collections
Version range not reported
- eap8-apache-commons-io
Version range not reported
- eap8-apache-commons-lang
Version range not reported
- eap8-apache-cxf
Version range not reported
- eap8-artemis-native
Version range not reported
- eap8-artemis-wildfly-integration
Version range not reported
- eap8-asyncutil
Version range not reported
- eap8-aws-java-sdk
Version range not reported
- eap8-cryptacular
Version range not reported
- eap8-eap-product-conf-parent
Version range not reported
- eap8-fastinfoset
Version range not reported
- eap8-hibernate
Version range not reported
- eap8-hibernate-validator
Version range not reported
- eap8-hppc
Version range not reported
- eap8-insights-java-client
Version range not reported
- eap8-jakarta-servlet-jsp-jstl-api
Version range not reported
- eap8-jboss-cert-helper
Version range not reported
- eap8-jboss-logging
Version range not reported
- eap8-jctools
Version range not reported
- eap8-jgroups
Version range not reported
- eap8-log4j
Version range not reported
- eap8-narayana
Version range not reported
- eap8-nimbus-jose-jwt
Version range not reported
- eap8-objectweb-asm
Version range not reported
- eap8-pem-keystore
Version range not reported
- eap8-resteasy-extensions
Version range not reported
- eap8-resteasy-spring
Version range not reported
- eap8-saaj-impl
Version range not reported
- eap8-shibboleth-java-support
Version range not reported
- eap8-slf4j
Version range not reported
- eap8-snakeyaml
Version range not reported
- eap8-wildfly
Version range not reported
- eap8-activemq-artemis
Version range not reported
- eap8-activemq-artemis-native
Version range not reported
- eap8-aesh-extensions
Version range not reported
- eap8-aesh-readline
Version range not reported
- eap8-apache-commons-codec
Version range not reported
- eap8-apache-commons-collections
Version range not reported
- eap8-apache-commons-io
Version range not reported
- eap8-apache-commons-lang
Version range not reported
- eap8-apache-cxf
Version range not reported
- eap8-artemis-native
Version range not reported
- eap8-artemis-wildfly-integration
Version range not reported
- eap8-asyncutil
Version range not reported
- eap8-aws-java-sdk
Version range not reported
- eap8-cryptacular
Version range not reported
- eap8-eap-product-conf-parent
Version range not reported
- eap8-fastinfoset
Version range not reported
- eap8-hibernate
Version range not reported
- eap8-hibernate-validator
Version range not reported
- eap8-hppc
Version range not reported
- eap8-insights-java-client
Version range not reported
- eap8-jakarta-servlet-jsp-jstl-api
Version range not reported
- eap8-jboss-cert-helper
Version range not reported
- eap8-jboss-logging
Version range not reported
- eap8-jctools
Version range not reported
- eap8-jgroups
Version range not reported
- eap8-log4j
Version range not reported
- eap8-narayana
Version range not reported
- eap8-nimbus-jose-jwt
Version range not reported
- eap8-objectweb-asm
Version range not reported
- eap8-pem-keystore
Version range not reported
- eap8-resteasy-extensions
Version range not reported
- eap8-resteasy-spring
Version range not reported
- eap8-saaj-impl
Version range not reported
- eap8-shibboleth-java-support
Version range not reported
- eap8-slf4j
Version range not reported
- eap8-snakeyaml
Version range not reported
- eap8-wildfly
Version range not reported
- keycloak-saml-core
Version range not reported
- rh-sso7-keycloak
Version range not reported
- rh-sso7-keycloak
Version range not reported
- rh-sso7-keycloak
Version range not reported
- rh-sso-7/sso76-openshift-rhel8
Version range not reported
- keycloak-saml-core-public
Version range not reported
- keycloak-saml-core-public
Version range not reported
- org.keycloak:keycloak-saml-coreMaven
fixed in 22.0.13
- org.keycloak:keycloak-saml-coreMaven
From 23.0.0 · fixed in 24.0.8
- org.keycloak:keycloak-saml-coreMaven
From 25.0.0 · fixed in 25.0.6