GHSA-m98g-63qj-fp8j Reflected XSS on clients-registrations endpoint
Attackers can execute malicious scripts in user browsers via unescaped error messages in the client registration endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-m98g-63qj-fp8j?
GHSA-m98g-63qj-fp8j is a cross-site scripting vulnerability in org.keycloak:keycloak-parent, published on 28 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.
Acknowledgement
Keycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.
Which versions are affected by GHSA-m98g-63qj-fp8j?
2 open source packages ship an affected version, including org.keycloak:keycloak-parent.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-parent Maven | From 10.0.0 | 18.0.0 |
org.keycloak:keycloak-parent Maven | From 10.0.0 | 18.0.0 |
How do I fix GHSA-m98g-63qj-fp8j?
Upgrade org.keycloak:keycloak-parent to 18.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-m98g-63qj-fp8j being exploited?
There is no known exploitation of GHSA-m98g-63qj-fp8j in the wild and no public exploit code.