GHSA-8rmm-gm28-pj8qMediumCVSS 6.0

Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow

Published
April 17, 2024
Last Modified
August 29, 2024

🔗 CVE IDs covered (1)

CVE-2023-6717 →

📋 Description

Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL (ACS), including JavaScript URIs (javascript:).

Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission.

Acknowledgements:

Special thanks to Lauritz Holtmann for reporting this issue and helping us improve our project.

🎯 Affected products2

  • maven/org.keycloak:keycloak-services:< 22.0.10
  • maven/org.keycloak:keycloak-services:>= 23.0.0, < 24.0.3

🔗 References (10)