Improper Access Control in Keycloak Admin API Exposes Backend Schema

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is an Improper Access Control flaw in the Keycloak Admin REST API. It allows a user with only low-privilege 'create-client' permission to access an endpoint that exposes internal user profile schema data, such as attribute names, validation rules, display metadata, and permission mappings. Although it does not disclose actual user account data, it leaks backend schema and configuration metadata due to insufficient authorization checks, enabling an authenticated, minimally privileged user to retrieve sensitive information remotely. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by exposing backend schema and rules to low-privilege users, which could allow attackers to craft targeted attacks or attempt privilege escalation. This means that even users with minimal permissions might gain insights that help them exploit the system further, potentially compromising security. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if a user with low privileges (such as the 'create-client' permission) can access the `/admin/realms/master/users/profile` endpoint on the Keycloak Admin REST API. A practical detection method is to authenticate as a low-privilege user and attempt to send an HTTP GET request to this endpoint. For example, using curl: `curl -i -H "Authorization: Bearer <token>" https://<keycloak-server>/admin/realms/master/users/profile`. If the response returns backend schema and configuration metadata, the system is vulnerable. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the `/admin/realms/master/users/profile` endpoint to only fully authorized users, reviewing and tightening the permissions associated with the 'create-client' role to prevent access to sensitive endpoints, and applying any available patches or updates from Keycloak or your vendor that address this improper access control vulnerability. [1]

Useful 0 Not Useful 0