CVE-2021-20323 — AI Deep Analysis Summary

🚨 **Essence**: Reflected XSS in Keycloak's `clients-registrations` endpoint. 📉 **Consequences**: Malicious JS executes in victim's browser. 💥 **Impact**: Session hijacking, credential theft, or defacement.…

🛡️ **CWE**: CWE-79 (Improper Neutralization of Input During Web Page Generation). 🔍 **Flaw**: POST request parameters (JSON keys) are reflected in error messages without sanitization.…

🏢 **Vendor**: Red Hat Keycloak. 📦 **Component**: `keycloak-services`. 📅 **Affected Versions**: Before 18.0.0 AND after 10.0.0. 🌍 **Scope**: Impacts ALL available realms on the instance.

🕵️ **Privileges**: No authentication required! 🎯 **Data Access**: Can steal session cookies, tokens, or personal data of logged-in users. 🔄 **Action**: Execute arbitrary JavaScript in the context of the victim's browser.

⚡ **Threshold**: LOW. 🚫 **Auth**: None required. 📤 **Trigger**: Simple POST request with a malformed JSON key. 🌐 **Access**: Publicly accessible endpoint. Anyone can trigger it!

🔓 **Exploits**: YES. Multiple PoCs available on GitHub (e.g., ndmalc, Cappricio-Securities). 🛠️ **Tools**: Scanners like Nuclei and custom Python tools exist.…

🔍 **Check**: Send POST to `/clients-registrations` with a JSON key containing HTML/JS. 👀 **Observe**: Look for reflected script in `text/html` response.…

🛡️ **Fix**: Upgrade Keycloak to version **18.0.0 or later**. ✅ **Official**: Red Hat has addressed this in newer releases. 📦 **Action**: Apply vendor patches immediately.

🚧 **Workaround**: If patching isn't possible, implement WAF rules to block POST requests with suspicious JSON keys. 🚫 **Filter**: Sanitize input at the reverse proxy level.…

🔥 **Priority**: HIGH. 🚨 **Urgency**: Critical due to zero-auth requirement and widespread impact. ⏳ **Action**: Patch immediately. 📢 **Alert**: Notify all users of affected Keycloak instances.