CVE-2021-20202: 
Java vulnerability analysis and mitigation

A temporary directory hijacking vulnerability was discovered in Keycloak, identified as CVE-2021-20202. The vulnerability was discovered on January 29, 2021, and affects Unix-like systems (excluding MacOS) where the system temporary directory is shared between all users. The issue stems from incorrect file permissions and directory creation verification in the Java process (Red Hat Bugzilla).

The vulnerability occurs because directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions. Since the directory names are not randomized, an attacker can create these directories ahead of Keycloak. When this happens, the Java process doesn't complain about pre-existing directories, with mkdir and mkdirs simply returning false. By default, directories are created with drwxr-xr-x permissions, allowing malicious local users to read the contents of the temporary directory (Red Hat Bugzilla).

The vulnerability can lead to local information disclosure or local file hijacking by another user. In the worst-case scenario, this could result in a local privilege escalation vulnerability. The issue allows malicious local users to read the contents of the temporary directory, potentially compromising sensitive information (Red Hat Bugzilla).

The vulnerability can be exploited by local attackers who can create directories before the Java process initializes them. Since the directory names are predictable and not randomized, exploitation is straightforward for attackers with local access to the system (Red Hat Bugzilla).

The recommended mitigation is to switch to the Files API, which allows exclusive setting of file permissions when creating directories or creating temporary directories. This vulnerability was addressed in Keycloak version 13.0.0 (Red Hat Bugzilla).

The vulnerability was discovered and reported by security researcher Jonathan Leitschuh (Twitter: JLLeitschuh) (Red Hat Bugzilla).