[org.keycloak:keycloak-parent] Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles

A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including version 19.0.1. The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the default roles functionality. Version 19.0.2 contains a patch for this issue.

Credits

Aytaç Kalıncı, Ilker Bulgurcu, Yasin Yılmaz (@aytackalinci, @smileronin, @yasinyilmaz) – NETAŞ PENTEST TEAM

References

• https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49
• https://nvd.nist.gov/vuln/detail/CVE-2022-2256
• https://github.com/keycloak/keycloak/commit/8e705a65ab2aa2b079374ec859ee7a75fad5a7d9
• https://bugzilla.redhat.com/show_bug.cgi?id=2101942
• https://github.com/advisories/GHSA-w9mf-83w3-fv49