[ASA-202102-29] keycloak: cross-site scripting

[Morten Linderud]

Arch Linux Security Advisory ASA-202102-29
==========================================

Severity: High
Date    : 2021-02-20
CVE-ID  : CVE-2021-20195
Package : keycloak
Type    : cross-site scripting
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1578

Summary
=======

The package keycloak before version 12.0.3-1 is vulnerable to cross-
site scripting.

Resolution
==========

Upgrade to 12.0.3-1.

# pacman -Syu "keycloak>=12.0.3-1"

The problem has been fixed upstream in version 12.0.3.

Workaround
==========

None.

Description
===========

A security issue was found in keycloak before version 12.0.3. A self
stored cross-site scripting (XSS) attack vector escalating to a
complete account takeover is possible due to user-supplied data fields
not being properly encoded and Javascript code being used to process
the data. Specifically, the Account page does not HTML-encode the user
first name, and last name, which means a malicious HTML code, which
executes malicious Javascript code, can be embedded into the Account
page. Even though the malicious Javascript code is linked to the
attacker user (Self-XSS), it can be exploited on the Keycloak admin
browser, using the Impersonation functionality, and thus the attacker
is able to compromise Keycloak.

Impact
======

A malicious user can execute arbitrary code in Keycloak's account page
possibly compromising Keycloak's admin account.

References
==========

https://bugzilla.redhat.com/show_bug.cgi?id=1919143
https://issues.redhat.com/browse/KEYCLOAK-16890
https://github.com/keycloak/keycloak/commit/87422b77aee787c6c55ca22fde31c60bcfe4c7f7
https://security.archlinux.org/CVE-2021-20195
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210225/b72994c4/attachment-0001.sig>