Keycloak SSRF Vulnerability in keycloak-parent Package
Summary
GHSA-fwhw-chw4-gh37: Keycloak Server-Side Request Forgery (SSRF) vulnerability. Affects org.keycloak:keycloak-parent versions < 26.5.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution designed for modern applications and services. It provides features such as single sign-on, identity brokering, and user federation. The keycloak-parent package serves as a parent project for Keycloak modules, facilitating dependency management and versioning. However, a vulnerability has been identified in its CIBA (Client Initiated Backchannel Authentication) feature, which can lead to server-side request forgery (SSRF) attacks.
Vulnerability Detail
A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services. This vulnerability could potentially expose sensitive internal services to unauthorized access, leading to data breaches or service disruptions. The issue arises from the lack of proper validation mechanisms for the endpoints configured by clients, allowing malicious actors to exploit this oversight.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that the backchannel notification endpoints configured in Keycloak are strictly validated and do not point to internal services. This can help mitigate the risk of SSRF attacks until the package is updated.
Conclusion
The Keycloak SSRF vulnerability in the keycloak-parent package poses a significant risk due to insufficient validation of backchannel notification endpoints. It is crucial for users to update to the latest patched version and implement recommended workarounds to safeguard their applications against potential exploitation.
See every vulnerability recorded for org.keycloak:keycloak-parent →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external services, potentially leading to unauthorized access or data exposure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized access to internal services, data breaches, and service disruptions, which can compromise the security and integrity of your application.
Yes, a patched version of the keycloak-parent package is available. It is recommended to update to the latest version to mitigate the vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software by analyzing the pom.xml file, helping developers maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-parent.
