-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | <= 26.4.7 |
Miggo AIRoot Cause AnalysisThe vulnerability is an improper access control issue in Keycloak's Admin REST API, specifically concerning the endpoint for managing roles. The root cause lies in the org.keycloak.authorization.jpa.store.JPAPolicyStore.findDependentPolicies method, which is responsible for fetching authorization policies. The pre-patch version of this method had a flaw where it would query for policies with either 'view' or 'view-members' scopes, without distinguishing between the type of resource being accessed. This meant that a user having 'view-members' permission on a group could inadvertently gain 'view' access to other resources, such as role metadata, which should have been restricted.
The patch addresses this by introducing a groupResourceType parameter to the findDependentPolicies method and its callers. This allows the method to differentiate the context of the permission check. If the check is related to groups, it looks for the 'view-members' scope; otherwise, it looks for the 'view' scope. This ensures that permissions are not incorrectly applied across different resource types.
The function org.keycloak.authorization.policy.provider.role.RolePolicyProvider.getPermissions is a key part of the call chain for this vulnerability. When a user accesses the roles endpoint, this provider is invoked to check permissions, which then calls the flawed findDependentPolicies method. Therefore, both of these functions would appear in a runtime profile during exploitation.
org.keycloak.authorization.jpa.store.JPAPolicyStore.findDependentPoliciesmodel/jpa/src/main/java/org/keycloak/authorization/jpa/store/JPAPolicyStore.java
org.keycloak.authorization.policy.provider.role.RolePolicyProvider.getPermissionsauthz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProvider.java