4 ms·

Keycloak open redirect: wildcard redirect URIs can be exploited to steal tokens

108 points by pontushanssen 3y ago

pontushanssen 3y ago
CVE-2023-6927 Keycloak vulnerability allows bypassing redirect URI validation which can be used as a vector for stealing authorization codes, access tokens and be used to redirect victims to arbitrary hosts.
never_inline 3y ago
> The vulnerability affects all OAuth 2.0 clients configured with a redirect URI ending with a * in Keycloak < 23.0.4. How common is a wildcard in a redirect URL?
- pwntus_se 3y ago
  I've seen it in multiple installs, and it's used by keycloak's default clients used for the admin app and for the account portals for realms.
- Klathmon 3y ago
  It's pretty common in my experience, especially at places that have multiple "apps" behind the same auth.
- pwntus_se 3y ago
  However, stealing access tokens is only possible with public clients. The open redirect works on both public and confidential clients.
- maxwellg 3y ago
  IME Wildcard redirect URLs have become more common in recent years due to the rise of preview environments. If you're deploying a git branch to Vercel, and you now want to log in to <project-name>-git-<branch-name>-<scope-slug>.vercel.app, then you don't want to bother with configuring a different redirect URL for every branch name. Enter the wildcard. Ideally wildcards are only used in dev/staging environments, but if the system allows for misconfiguration, the system will be misconfigured.
- jdsleppy 3y ago
  I use it to allow a ?next={url} query parameter in the redirect so I can send users to the page they originally wanted to visit. It becomes more important the faster the access tokens expire because a user can reauth multiple times in a session. The other way might be to put that URL in redis or something, maybe that's better?
  - pwntus_se 3y ago
    You could store that information in the client. Store a reference from the value of the state parameter to the deep link url you want. https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1 https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1
WirelessGigabit 3y ago
Nitpick, but with security issues relevance is important. Relevant can be many things, and one of them is time. If I see a blogpost from 2006 with a security issue it's probably not that relevant anymore. When was this posted? I don't know. All I see is the CVE date.
- pontushanssen 3y ago
  It was published 2024-01-11. The page has been updated to include the publish date. Thanks for the feedback!
apitman 3y ago
I made a (rather incomplete) comparision of various OpenID Connect server implementations[0]. Keycloak has over 1M lines of code. LOC isn't everything, but I don't know how you're supposed to avoid a decent number of serious vulnerabilities with that much surface area. [0]: https://github.com/lastlogin-io/obligator#comparison-is-the-thief-of-joy https://github.com/lastlogin-io/obligator#comparison-is-the-...
- marcosdumay 3y ago
  My knee-jerk reaction would be to agree with that. But every single vulnerability I remember being announced for Keycloak was due to some footgun for the authentication protocol. So, I do assess the risk of a less tested but simpler implementation being way higher than of a well tested complex one. What leads to the obvious conclusion that it's best to avoid the protocol completely. But if you don't do that, I'd recommend using the mainstream software.
  - merb 3y ago
    wildcard redirects are not kommen and the spec talks about redirect validation
    - marcosdumay 3y ago
      > redirect validation This is an incredibly efficient footgun factory all by itself.
- acdha 3y ago
  It’s also how it’s hosted: running as an enterprise Java app means you’re getting a high/critical CVE every week for something you probably don’t even use but which is bundled into something like Wildfly. Looking at it currently, I see SnakeYAML, the Apache SSHD, the H2 database, the Infinispan cache, etc. which are just generic Wildfly features and probably not even enabled, but you have to either be very confident about your ability to make that assertion or patching it frequently. This kind of service really needs to be lean and bundling only the dependencies it uses.
liminal 3y ago
Does this exploit require the page with the specially crafted link to be on the host secured by Keycloak?
hsluoyz 3y ago
I'm using Casdoor: https://github.com/casbin/casdoor https://github.com/casbin/casdoor and glad to see it only has ~77,000 LOC according to the shared link. Keycloak was good but has too much legacy for 10+ years. Casdoor is pretty new and has become a good replacement for Keycloak for me with more functionalities.
- KronisLV 3y ago
  > Keycloak was good but has too much legacy for 10+ years. I got curious, actually seems to check out and explains why it's so well documented (but also complex and oftentimes confusing): > The first production release of Keycloak was in September 2014, with development having started about a year earlier. https://en.wikipedia.org/wiki/Keycloak https://en.wikipedia.org/wiki/Keycloak https://github.com/keycloak/keycloak/releases/tag/1.0.0.Final https://github.com/keycloak/keycloak/releases/tag/1.0.0.Fina... It's kind of cool to see a project successfully survive for so long.
lakomen 3y ago
If you configure a prod client with a wildcard redirect uri that's your fault. It has nothing to do with Keycloak. If you configure a dev client with one, the prod backend won't accept this client. So this is rather, "don't be stupid", than keycloak bad

108 points by pontushanssen 3y ago

CVE-2023-6927 Keycloak vulnerability allows bypassing redirect URI validation which can be used as a vector for stealing authorization codes, access tokens and be used to redirect victims to arbitrary hosts.

never_inline 3y ago

> The vulnerability affects all OAuth 2.0 clients configured with a redirect URI ending with a * in Keycloak < 23.0.4. How common is a wildcard in a redirect URL?

pwntus_se 3y ago
I've seen it in multiple installs, and it's used by keycloak's default clients used for the admin app and for the account portals for realms.
Klathmon 3y ago
It's pretty common in my experience, especially at places that have multiple "apps" behind the same auth.
pwntus_se 3y ago
However, stealing access tokens is only possible with public clients. The open redirect works on both public and confidential clients.
maxwellg 3y ago
IME Wildcard redirect URLs have become more common in recent years due to the rise of preview environments. If you're deploying a git branch to Vercel, and you now want to log in to <project-name>-git-<branch-name>-<scope-slug>.vercel.app, then you don't want to bother with configuring a different redirect URL for every branch name. Enter the wildcard. Ideally wildcards are only used in dev/staging environments, but if the system allows for misconfiguration, the system will be misconfigured.
jdsleppy 3y ago
I use it to allow a ?next={url} query parameter in the redirect so I can send users to the page they originally wanted to visit. It becomes more important the faster the access tokens expire because a user can reauth multiple times in a session. The other way might be to put that URL in redis or something, maybe that's better?
- pwntus_se 3y ago
  You could store that information in the client. Store a reference from the value of the state parameter to the deep link url you want. https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1 https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1

WirelessGigabit 3y ago

Nitpick, but with security issues relevance is important. Relevant can be many things, and one of them is time. If I see a blogpost from 2006 with a security issue it's probably not that relevant anymore. When was this posted? I don't know. All I see is the CVE date.

pontushanssen 3y ago
It was published 2024-01-11. The page has been updated to include the publish date. Thanks for the feedback!

apitman 3y ago

I made a (rather incomplete) comparision of various OpenID Connect server implementations[0]. Keycloak has over 1M lines of code. LOC isn't everything, but I don't know how you're supposed to avoid a decent number of serious vulnerabilities with that much surface area. [0]: https://github.com/lastlogin-io/obligator#comparison-is-the-thief-of-joy https://github.com/lastlogin-io/obligator#comparison-is-the-...

marcosdumay 3y ago
My knee-jerk reaction would be to agree with that. But every single vulnerability I remember being announced for Keycloak was due to some footgun for the authentication protocol. So, I do assess the risk of a less tested but simpler implementation being way higher than of a well tested complex one. What leads to the obvious conclusion that it's best to avoid the protocol completely. But if you don't do that, I'd recommend using the mainstream software.
- merb 3y ago
  wildcard redirects are not kommen and the spec talks about redirect validation
  - marcosdumay 3y ago
    > redirect validation This is an incredibly efficient footgun factory all by itself.
acdha 3y ago
It’s also how it’s hosted: running as an enterprise Java app means you’re getting a high/critical CVE every week for something you probably don’t even use but which is bundled into something like Wildfly. Looking at it currently, I see SnakeYAML, the Apache SSHD, the H2 database, the Infinispan cache, etc. which are just generic Wildfly features and probably not even enabled, but you have to either be very confident about your ability to make that assertion or patching it frequently. This kind of service really needs to be lean and bundling only the dependencies it uses.

liminal 3y ago

Does this exploit require the page with the specially crafted link to be on the host secured by Keycloak?

hsluoyz 3y ago

I'm using Casdoor: https://github.com/casbin/casdoor https://github.com/casbin/casdoor and glad to see it only has ~77,000 LOC according to the shared link. Keycloak was good but has too much legacy for 10+ years. Casdoor is pretty new and has become a good replacement for Keycloak for me with more functionalities.

KronisLV 3y ago
> Keycloak was good but has too much legacy for 10+ years. I got curious, actually seems to check out and explains why it's so well documented (but also complex and oftentimes confusing): > The first production release of Keycloak was in September 2014, with development having started about a year earlier. https://en.wikipedia.org/wiki/Keycloak https://en.wikipedia.org/wiki/Keycloak https://github.com/keycloak/keycloak/releases/tag/1.0.0.Final https://github.com/keycloak/keycloak/releases/tag/1.0.0.Fina... It's kind of cool to see a project successfully survive for so long.

lakomen 3y ago

If you configure a prod client with a wildcard redirect uri that's your fault. It has nothing to do with Keycloak. If you configure a dev client with one, the prod backend won't accept this client. So this is rather, "don't be stupid", than keycloak bad