Bug 2010164 (CVE-2021-3856)

Summary:	CVE-2021-3856 keycloak-services: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader
Product:	[Other] Security Response	Reporter:	Paramvir jindal <pjindal>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	chazlett, jochrist, jross, jwon, pdrozd, pjindal, rgodfrey, sthorger
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2009712, 2010282

Description Paramvir jindal 2021-10-04 05:21:20 UTC

https://issues.redhat.com/browse/KEYCLOAK-19422

https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/theme/ClasspathThemeResourceProviderFactory.java

The ThemeResource resource exposes an endpoint for fetching theme resources:

@GET
@Path("/{version}/{themeType}/{themeName}/{path:.*}")
public Response getResource(@PathParam("version") String version, @PathParam("themeType") String themType, @PathParam("themeName") String themeName, @PathParam("path") String path) {
...
}

The classbased resource loaders are implemented as:

public InputStream getResourceAsStream(String path) {
    return classLoader.getResourceAsStream(resourceRoot + path);
}

This has no checks for the path parameter, allowing relative traversals like ../.

By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.

I practice this exposes any files packages within the deployed module, including other resources available as a classloader resource.

Disallowing double dots in the path component is probably the easiest fix

Comment 2 Jonathan Christison 2021-10-04 17:43:36 UTC

This vulnerability is out of security support scope for the following products:
 
* Red Hat AMQ Online 

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes and https://access.redhat.com/solutions/5941551 for more details.