Keycloak FGAP v2 ClientResource Privilege Escalation

Executive Summary

This vulnerability exists in Keycloak's ClientResource component when Fine-Grained Admin Permissions (FGAP) v2 is enabled. It allows a delegated administrator, who should have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to manage.

The root cause is insufficient permission validation: the system only checks if the caller has manage permissions on the target client but does not verify permissions on the client scope being attached. An attacker with delegated admin roles can exploit this by linking restricted client scopes to their managed clients.

This can lead to unauthorized claim injection into end-user access tokens, potentially tricking other applications into granting higher access levels than intended.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker with delegated admin privileges to inject unauthorized data or permissions into security tokens issued to end-users.

This unauthorized claim injection can cause relying applications to grant higher levels of access than intended, leading to potential authorization bypass.

Additionally, if the hidden client scopes contain sensitive claims or mappers, this could result in data exposure.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized attachment or removal of hidden client scopes by delegated administrators in Keycloak when Fine-Grained Admin Permissions (FGAP) v2 is enabled. Detection would involve monitoring administrative API calls related to client scope management, especially calls to endpoints like ClientResource.addDefaultClientScope() where permissions are insufficiently validated.

Specifically, detection could focus on identifying unusual or unauthorized modifications of client scopes by users with delegated admin roles who should not have permissions on those scopes.

However, no specific commands or detection scripts are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include reviewing and restricting delegated administrator permissions to ensure they do not have manage permissions on clients unless absolutely necessary.

Additionally, disabling Fine-Grained Admin Permissions (FGAP) v2 or avoiding enabling adminPermissionsEnabled until a patch or fix is applied can prevent exploitation.

Monitoring and auditing client scope attachment operations for suspicious activity is also recommended.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized injection of claims into end-user access tokens, which can lead to unauthorized access and potential exposure of sensitive data.

Such unauthorized data exposure and elevated access permissions could result in non-compliance with data protection regulations like GDPR and HIPAA, which require strict control over access to personal and sensitive information.

Useful 0 Not Useful 0