-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-ldap-federation | maven | < 26.4.6 | 26.4.6 |
Miggo AIRoot Cause AnalysisThe vulnerability is a classic case of Deserialization of Untrusted Data (CWE-502) within the Keycloak LDAP User Federation provider. It occurs when an administrator configures Keycloak to use a malicious LDAP server that returns a JNDI referral. The JNDI framework, by default, can process these referrals in an unsafe way, potentially fetching and instantiating arbitrary Java objects from a remote location, which leads to Remote Code Execution (RCE).
The patch addresses this by introducing a security control that was previously missing. It does not modify a single vulnerable function but rather adds a new mechanism to secure the JNDI context.
The analysis of the patch commit 754c070cf8ca187dcc71f0f72ff3130ff2195328 reveals the following:
LDAPStorageProviderFactory.init method, which is called when the LDAP provider is initialized, is modified to set up a secure JNDI environment. In vulnerable versions, this method did not perform this crucial setup, leaving the application in a vulnerable state.ObjectFactoryBuilder, is introduced. Its purpose is to intercept the handling of JNDI referrals. The createObjectFactory method within this class inspects the referral Reference object.getLdapUrl helper method ensures that any URL within the referral is a safe LDAP URL (i.e., starts with ldap). If any other protocol is found, the referral is rejected, thus preventing the JNDI framework from accessing malicious remote endpoints.Therefore, the vulnerability is caused by the absence of this validation logic. The identified functions are critical because init is where the security control should have been enabled, and createObjectFactory and getLdapUrl are the new functions that now process the potentially malicious input (the JNDI referral) securely.
org.keycloak.storage.ldap.LDAPStorageProviderFactory.initfederation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProviderFactory.java
org.keycloak.storage.ldap.ObjectFactoryBuilder.createObjectFactoryfederation/ldap/src/main/java/org/keycloak/storage/ldap/ObjectFactoryBuilder.java
org.keycloak.storage.ldap.ObjectFactoryBuilder.getLdapUrlfederation/ldap/src/main/java/org/keycloak/storage/ldap/ObjectFactoryBuilder.java
JavaJavaOngoing coverage of React2Shell