CVE-2023-6717: 
Java vulnerability analysis and mitigation

A vulnerability (CVE-2023-6717) was discovered in the SAML client registration functionality of Keycloak. The flaw was disclosed on April 25, 2024, affecting Keycloak's SAML client registration system. This vulnerability allows an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), creating a Cross-Site Scripting (XSS) risk (NVD, Red Hat CVE).

The vulnerability stems from Keycloak's insufficient validation of SAML Assertion Consumer Service POST Binding URLs, which permits the registration of JavaScript URIs. When combined with HTML forms, this can lead to JavaScript code execution in the context of the embedding origin upon form submission. The vulnerability has been assigned a CVSS v3.1 base score of 6.0 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L, indicating network accessibility with high attack complexity, high privileges required, and user interaction needed (Red Hat CVE).

The vulnerability can enable a malicious admin in one realm or a client with registration access to target users in different realms or applications. By executing arbitrary JavaScript in their contexts upon form submission, attackers can potentially gain unauthorized access and perform harmful actions. This compromises the confidentiality, integrity, and availability of the complete Keycloak instance (NVD).

The vulnerability requires high privileges (administrator access or client registration permissions) and user interaction for successful exploitation. The attack complexity is considered high, as it involves crafting specific malicious JavaScript URIs and requires users to submit forms for the attack to be executed (Red Hat CVE).

Red Hat has addressed this vulnerability in multiple products including Red Hat build of Keycloak 22.0.10, Red Hat Process Automation Manager 7.13.5, and Red Hat AMQ Broker 7.12.0. Updates are available through various security advisories including RHSA-2024:1867, RHSA-2024:1868, and RHSA-2024:2945 (Red Hat Advisory).