Keycloak RoleContainerResource Authorization Bypass Vulnerability

Executive Summary

This vulnerability is in Keycloak's RoleContainerResource component. It involves missing authorization checks in the admin REST API's name-based endpoints for managing composite roles. A delegated admin with manage-realm permissions can exploit this to remove critical child roles from built-in admin roles, disrupting administrative functions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Keycloak admin REST API logs for unauthorized DELETE requests to name-based composite endpoints like /admin/realms/{realm}/roles/{role-name}/composites. Check for unusual removal of child roles from built-in admin roles such as manage-users, impersonation, or manage-clients.

Useful 0 Not Useful 0

Impact Analysis

An attacker with manage-realm permissions could remove essential roles like manage-users or impersonation from admin accounts. This would degrade other administrators' permissions, potentially locking them out of critical functions or enabling unauthorized access if combined with other flaws.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by allowing unauthorized privilege reduction for administrators. If an attacker removes critical roles like manage-users or impersonation from built-in admin roles, it may disrupt legitimate administrative functions, potentially leading to unauthorized access or data exposure. However, the direct impact depends on the specific deployment and role assignments.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Keycloak security patches immediately. Review and restrict delegated administrator permissions to ensure they cannot modify built-in admin roles. Temporarily disable name-based composite endpoints if patches are not available.

Useful 0 Not Useful 0