Executive Summary

[{'type': 'paragraph', 'content': 'This vulnerability is an improper authorization flaw in the Docker v2 authentication endpoint of Keycloak. Specifically, the server does not check if a Docker registry client is enabled before issuing access tokens. Even if a client has been administratively disabled, the endpoint will still issue valid authentication tokens when valid user credentials and the disabled client\'s ID are presented. This means that turning off the client\'s "Enabled" setting does not fully prevent access.'}, {'type': 'paragraph', 'content': 'As a result, previously valid credentials can still be used to obtain authentication tokens, bypassing intended administrative restrictions.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability weakens administrative controls by allowing authentication tokens to be issued even for disabled clients. Consequently, authenticated users may gain unauthorized access to container registry resources that should have been restricted.

This could lead to unintended access to sensitive container images or data stored in the registry, potentially compromising security.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

I don't know

Useful 0 Not Useful 0