LDAP Search Boundary Bypass in Keycloak

Executive Summary

This vulnerability is in Keycloak's LDAP storage provider, which manages user identities from external directories. A delegated administrator can exploit missing validation in search queries to look up users outside the intended search boundary. This allows disclosure of user account details from unauthorized parts of the LDAP directory and may import those users into the local Keycloak database.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Keycloak admin endpoints for unusual queries using the LDAP_ENTRY_DN parameter. Check logs for requests to /admin/realms/{realm}/users with q=LDAP_ENTRY_DN:target-dn. Unauthorized LDAP DN lookups outside configured boundaries may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker with delegated admin privileges could access user account information from unauthorized LDAP Organizational Units (OUs). This may lead to unauthorized disclosure of sensitive user attributes and metadata. Additionally, the attacker could import unauthorized users into the local Keycloak database, potentially affecting access control and user management.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's privacy rules. Exposure of user attributes from unauthorized OUs may result in non-compliance with data access and protection requirements, potentially leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Keycloak patches immediately. Restrict delegated administrator privileges to only necessary users. Review LDAP provider configurations to ensure proper search boundary validation. Monitor for unauthorized user imports and LDAP queries outside configured OUs.

Useful 0 Not Useful 0