A security issue was found in keycloak before version 13.0.0. A self stored cross-site scripting (XSS) attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. Specifically, the Account page does not HTML-encode the user first name, and last name, which means a malicious HTML code, which executes malicious Javascript code, can be embedded into the Account page. Even though the malicious Javascript code is linked to the attacker user (Self-XSS), it can be exploited on the Keycloak admin browser, using the Impersonation functionality, and thus the attacker is able to compromise Keycloak.
A security issue was found in keycloak before version 13.0.0. A self stored cross-site scripting (XSS) attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. Specifically, the Account page does not HTML-encode the user first name, and last name, which means a malicious HTML code, which executes malicious Javascript code, can be embedded into the Account page. Even though the malicious Javascript code is linked to the attacker user (Self-XSS), it can be exploited on the Keycloak admin browser, using the Impersonation functionality, and thus the attacker is able to compromise Keycloak.
https://bugzilla.redhat.com/show_bug.cgi?id=1919143 https://issues.redhat.com/browse/KEYCLOAK-16890
Vulmon