ArchLinux: 202102-29: keycloak: cross-site scripting
Summary
A security issue was found in keycloak before version 12.0.3. A self stored cross-site scripting (XSS) attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. Specifically, the Account page does not HTML-encode the user first name, and last name, which means a malicious HTML code, which executes malicious Javascript code, can be embedded into the Account page. Even though the malicious Javascript code is linked to the attacker user (Self-XSS), it can be exploited on the Keycloak admin browser, using the Impersonation functionality, and thus the attacker is able to compromise Keycloak.
Resolution
Upgrade to 12.0.3-1.
# pacman -Syu "keycloak>=12.0.3-1"
The problem has been fixed upstream in version 12.0.3.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1919143 https://issues.redhat.com/plugins/servlet/samlsso https://github.com/keycloak/keycloak/commit/87422b77aee787c6c55ca22fde31c60bcfe4c7f7 https://security.archlinux.org/CVE-2021-20195
Workaround
None.