Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow
Moderate severity
GitHub Reviewed
Published
Apr 17, 2024
in
keycloak/keycloak
•
Updated Apr 25, 2024
Package
Affected versions
< 22.0.10
>= 23.0.0, < 24.0.3
Patched versions
22.0.10
24.0.3
Description
Published to the GitHub Advisory Database
Apr 17, 2024
Reviewed
Apr 17, 2024
Published by the National Vulnerability Database
Apr 25, 2024
Last updated
Apr 25, 2024
Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL (ACS), including JavaScript URIs (javascript:).
Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission.
Acknowledgements:
Special thanks to Lauritz Holtmann for reporting this issue and helping us improve our project.
References