Information Disclosure in Keycloak Admin Interface

Executive Summary

This vulnerability exists in Keycloak's administrative interface when the Fine-Grained Admin Permissions version 2 (FGAP v2) feature is enabled.

An administrator who has permission to view a specific role can also see a list of all groups assigned to that role, even if they do not have permission to view those groups individually.

The system fails to check group-level permissions properly, allowing the administrator to discover hidden groups and view sensitive details such as internal names, paths, and custom settings.

This happens because the endpoints responsible for returning groups in a role only verify if the user can view the role, not the individual groups, due to a flaw in the RoleContainerResource.getGroupsInRole() method.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information about groups that an administrator should not have access to.

Restricted administrators may be able to discover hidden groups and view their metadata, including internal names, paths, and custom attributes.

Such exposure could reveal sensitive deployment information, potentially aiding attackers or unauthorized users in understanding the system's structure and configuration.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the Keycloak administrative interface endpoints related to roles and groups when Fine-Grained Admin Permissions v2 (FGAP v2) is enabled.

Specifically, you can attempt to access the following endpoints with an administrator account that has permission to view a role but should not have permission to view all groups assigned to that role:

• GET /admin/realms/{realm}/clients/{clientUuid}/roles/{roleName}/groups
• GET /admin/realms/{realm}/roles/{roleName}/groups

If these endpoints return group details such as internal names, paths, or custom attributes without proper permission checks, the vulnerability is present.

You can use tools like curl or any REST API client to perform these requests. For example:

• curl -H "Authorization: Bearer <token>" https://<keycloak-server>/admin/realms/<realm>/roles/<roleName>/groups
• curl -H "Authorization: Bearer <token>" https://<keycloak-server>/admin/realms/<realm>/clients/<clientUuid>/roles/<roleName>/groups

Replace <token>, <keycloak-server>, <realm>, <clientUuid>, and <roleName> with appropriate values. If group information is returned despite restricted permissions, the vulnerability exists.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, consider the following steps:

• Disable Fine-Grained Admin Permissions v2 (FGAP v2) if it is not strictly required, to prevent the flawed permission checks from being exploited.
• Restrict administrative roles so that only fully trusted administrators have permissions to view roles that could expose group information.
• Monitor and audit administrative API usage to detect any unusual access patterns to the affected endpoints.
• Apply any available patches or updates from Keycloak or your vendor that address this specific permission enforcement flaw.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows certain administrators to view information about groups they should not have access to, including sensitive deployment details such as internal names and custom settings.

Such unauthorized access to sensitive information could potentially lead to non-compliance with data protection standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data.

By exposing hidden groups and their metadata to restricted administrators, the system fails to enforce proper access controls, increasing the risk of data exposure and violating principles of least privilege and confidentiality mandated by these regulations.

Useful 0 Not Useful 0