A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permission manage-realm) to change the LDAP host URL (Connection URL) to a machine they control. The Keycloak server will connect to the attackers host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console or compromised a user with sufficient privileges can leak domain credentials and attack the domain.
During installation, installed file permissions are set to allow anyone to modify those files.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Build of Keycloak | RedHat | keycloak-core | * |
| Red Hat build of Keycloak 22 | RedHat | rhbk/keycloak-operator-bundle:22.0.12-1 | * |
| Red Hat build of Keycloak 22 | RedHat | rhbk/keycloak-rhel9:22-17 | * |
| Red Hat build of Keycloak 22 | RedHat | rhbk/keycloak-rhel9-operator:22-20 | * |
| Red Hat Single Sign-On 7 | RedHat | keycloak-core | * |
| Red Hat Single Sign-On 7.6 for RHEL 7 | RedHat | rh-sso7-keycloak-0:18.0.16-1.redhat_00001.1.el7sso | * |
| Red Hat Single Sign-On 7.6 for RHEL 8 | RedHat | rh-sso7-keycloak-0:18.0.16-1.redhat_00001.1.el8sso | * |
| Red Hat Single Sign-On 7.6 for RHEL 9 | RedHat | rh-sso7-keycloak-0:18.0.16-1.redhat_00001.1.el9sso | * |
| RHEL-8 based Middleware Containers | RedHat | rh-sso-7/sso76-openshift-rhel8:7.6-52 | * |