Bug 1791538 (CVE-2020-1697)

Summary:	CVE-2020-1697 keycloak: stored XSS in client settings via application links
Product:	[Other] Security Response	Reporter:	Paramvir jindal <pjindal>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboyko, aileenc, avibelli, bgeorges, cbyrne, chazlett, cmacedo, cmoulliard, dffrench, dkreling, drieden, drusso, ggaughan, ikanello, janstey, jbalunas, jmadigan, jochrist, jpallich, jshepherd, jwon, krathod, lthon, mszynkie, ngough, pdrozd, pgallagh, pjindal, pwright, rruss, security-response-team, sthorger, trepel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	keycloak 9.0.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found during the assessment of the Admin Console application for Keycloak, where it was found that Application Links to external applications are not validated properly. An attacker could use this flaw to cause Stored XSS attacks.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-06-01 17:20:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1785336

Description Paramvir jindal 2020-01-16 05:48:46 UTC

During the assessment of the Admin Console application, it was found that links to external applications, so called Application Links, does not get validated properly and therefore are prone to Stored XSS attacks. The affected parameter BaseURL within the Clients settings page from the admin console application accepts any characters and therefore it is possible to insert URLs with the javascript

https://issues.redhat.com/browse/KEYCLOAK-12459

Comment 4 Guilherme de Almeida Suckevicz 2020-01-21 13:11:56 UTC

Acknowledgments:

Name: Cure53 Berlin

Comment 12 errata-xmlrpc 2020-06-01 15:32:29 UTC

This issue has been addressed in the following products:

  Red Hat Runtimes Spring Boot 2.2.6

Via RHSA-2020:2252 https://access.redhat.com/errata/RHSA-2020:2252

Comment 13 Product Security DevOps Team 2020-06-01 17:20:31 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-1697

Comment 14 errata-xmlrpc 2020-07-23 07:04:13 UTC

This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:2905 https://access.redhat.com/errata/RHSA-2020:2905