Описание
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
Отчет
This Important vulnerability in Keycloak allows an authenticated user with the uma_protection role to bypass User-Managed Access (UMA) policy validation. Exploitation requires that victim users have created UMA-protected resources with ownerManagedAccess enabled and that authorization services are enabled on the client. This flaw enables an attacker to gain unauthorized permissions to victim-owned resources within Red Hat Build of Keycloak.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
A flaw was found in Keycloak. An authenticated user with the uma_prote ...
Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
EPSS
8.1 High
CVSS3