Executive Summary

This vulnerability exists in the IdentityBrokerService.performLogin endpoint of Keycloak. It allows authentication to proceed using an Identity Provider (IdP) even after the IdP has been disabled by an administrator.

An attacker who knows the IdP alias can reuse a previously generated login request or manually invoke the broker login URL with valid session parameters. This causes the authentication flow to continue and redirect the user to the external provider despite the IdP being administratively disabled.

As a result, this flaw bypasses administrative access control restrictions and allows unauthorized authentication through a disabled external provider.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact by undermining access control enforcement in Keycloak.

An attacker can authenticate through an Identity Provider that has been disabled by an administrator, potentially gaining unauthorized access to systems or data.

Since the vulnerability can be exploited remotely without any privileges, it poses a high security risk, especially in environments relying on Keycloak for authentication.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'Detection of this vulnerability involves monitoring for unauthorized authentication attempts through disabled Identity Providers (IdPs) in Keycloak. Since the vulnerability allows authentication via the broker login URL even after an IdP is disabled, you can look for unusual or unexpected access to the endpoint /realms/{realm}/broker/{alias}/login.'}, {'type': 'paragraph', 'content': 'Specifically, you can check your Keycloak server logs for requests to the broker login endpoint corresponding to disabled IdPs. Look for repeated or suspicious login attempts using known IdP aliases that should be disabled.'}, {'type': 'paragraph', 'content': 'While no explicit commands are provided in the resources, you can use network monitoring tools or log analysis commands such as:'}, {'type': 'list_item', 'content': 'Using grep to find broker login attempts in Keycloak logs: grep "/broker/" /path/to/keycloak/logs/server.log'}, {'type': 'list_item', 'content': 'Filter for disabled IdP aliases in the logs by combining grep with the alias name: grep "/broker/{alias}/login" /path/to/keycloak/logs/server.log'}, {'type': 'list_item', 'content': 'Use network monitoring tools like tcpdump or Wireshark to capture HTTP requests to the broker login URL and analyze for unauthorized access.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves ensuring that disabled Identity Providers (IdPs) cannot be used to authenticate users through the broker login endpoint.

Since the vulnerability arises because the broker login endpoint does not re-validate the enabled/disabled status of an IdP during login processing, you should:

• Apply any available security patches or updates from Keycloak or your vendor that address this specific issue.
• Temporarily disable or restrict access to the broker login endpoint (/realms/{realm}/broker/{alias}/login) until a patch is applied.
• Review and audit all IdP configurations to ensure that only necessary providers are enabled.
• Monitor authentication logs closely for any suspicious activity involving disabled IdPs.

Useful 0 Not Useful 0