GHSA-3p62-6fjh-3p5h

Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-4361

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.keycloak:keycloak-services	< 21.1.2	21.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS). AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.

References

External links from the advisory. They lead to third-party sites.

https://github.com/keycloak/keycloak/security/advisories/GHSA-3p62-6fjh-3p5h web
https://nvd.nist.gov/vuln/detail/CVE-2022-4361 advisory
https://github.com/keycloak/keycloak/commit/a1cfe6e24e5b34792699a00b8b4a8016a5929e3a web
https://bugzilla.redhat.com/show_bug.cgi?id=2151618 web
https://github.com/keycloak/keycloak package