Keycloak Authorization Services Path Normalization Flaw

Executive Summary

This vulnerability is in Keycloak's Authorization Services. The PathMatcher component fails to properly normalize URIs before comparing them to security policies. Attackers can exploit this by adding characters like trailing slashes or matrix parameters to URLs to bypass intended access restrictions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Keycloak logs for unusual URI access patterns, particularly requests with trailing slashes or matrix parameters (e.g., /admin/;x=1) that bypass intended security policies. Check if PathMatcher incorrectly matches broader resources instead of restricted ones.

Useful 0 Not Useful 0

Impact Analysis

An authenticated user could exploit this flaw to access administrative or restricted areas they should not have permission to see. This could lead to unauthorized data access, privilege escalation, or other security breaches depending on the system's configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. It may result in data breaches, legal penalties, and loss of trust due to inadequate access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Update Keycloak to the latest version that fixes this PathMatcher flaw. Review and tighten authorization policies to ensure proper URI matching. Test policies to confirm they block unauthorized access attempts with modified URIs.

Useful 0 Not Useful 0