Compliance Impact

This vulnerability allows an attacker to achieve full realm takeover by compromising administrator accounts, leading to a complete compromise of confidentiality, integrity, and availability of the system.

Such a compromise can result in unauthorized access to sensitive personal data or protected health information, which may violate compliance requirements under standards like GDPR and HIPAA that mandate strict controls over data confidentiality and integrity.

Therefore, exploitation of this vulnerability could lead to non-compliance with these regulations due to potential data breaches and failure to maintain adequate access controls.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Keycloak's Admin REST API, specifically in the GroupResource.addChild() endpoint. It is caused by a missing authorization check that allows an authenticated user with limited administrative privileges to reparent any existing group.

When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker who manages a low-privilege group can reparent a highly privileged group, such as one with the realm-admin role, under their control.

Because group permissions are hierarchical, this unauthorized reparenting grants the attacker management and password-reset capabilities over members of the privileged group, enabling them to reset an administrator's password and potentially take over the entire realm.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a full realm takeover in Keycloak, compromising the confidentiality, integrity, and availability of the system.

An attacker exploiting this flaw can reset administrator passwords, gain unauthorized management access, and control privileged accounts.

Such a compromise can result in unauthorized access to sensitive data, disruption of services, and loss of trust in the security of the system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that Fine-Grained Admin Permissions v2 (FGAPv2) is carefully configured and monitored to prevent unauthorized reparenting of groups.

Limit management rights over groups to trusted administrators only, especially for groups with high privileges such as those possessing the realm-admin role.

Apply any available patches or updates from Keycloak or your vendor that address this authorization flaw in the GroupResource.addChild() endpoint.

Review and audit group hierarchy changes regularly to detect any unauthorized reparenting activities.

Useful 0 Not Useful 0