Secure Client URIs Policy Bypass in Keycloak

Executive Summary

This vulnerability is in Keycloak's secure-client-uris client policy executor. It allows attackers to bypass security checks for redirect URIs by crafting domain names that trick the system into accepting unencrypted connections. The flaw occurs because the system only checks the start of a web address rather than verifying the full host.

Useful 0 Not Useful 0

Detection Guidance

Check Keycloak client configurations for redirect URIs starting with 'http://localhost' or 'http://127.0.0.1' followed by additional malicious domains. Inspect logs for Dynamic Client Registration attempts with such URIs. Use network monitoring to detect unencrypted HTTP traffic to unexpected domains during authentication flows.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to intercept sensitive authentication codes sent over unencrypted connections. This may lead to unauthorized access to user accounts or sensitive data during authentication flows.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate encrypted transmission of sensitive data, such as GDPR's data protection principles or HIPAA's security rules for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update Keycloak to the latest version that patches this flaw. Review client redirect URI configurations to ensure they enforce encrypted connections. Monitor network traffic for suspicious domains attempting to bypass security checks.

Useful 0 Not Useful 0