cbcvebase.
CVE-2021-20323
published 2022-03-25

CVE-2021-20323: A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.

PriorityP350medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
37.25%
98.4th percentile
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.

Affected

1 ranges
VendorProductVersion rangeFixed in
redhatkeycloak< 17.0.017.0.0

Detection & IOCsextracted from sources · hover to see the quote

url/auth/realms/master/clients-registrations/default
url/auth/realms/master/clients-registrations/openid-connect
url/realms/master/clients-registrations/default
url/realms/master/clients-registrations/openid-connect
otherhttp.favicon.hash:-1105083093
  • →Look for POST requests to the clients-registrations endpoint (both /auth/realms/*/clients-registrations/default and /auth/realms/*/clients-registrations/openid-connect) with Content-Type: application/json containing unknown/arbitrary JSON field names.
  • →Detect HTTP 400 responses from the clients-registrations endpoint where the response body contains 'Unrecognized field' and the response Content-Type is text/html — this indicates the unsanitized field name is being reflected as HTML.
  • →Match on response Content-Type of text/html for requests to the clients-registrations endpoint, as the server incorrectly returns text/html (typo: 'text/hml' in advisory) for JSON error responses, enabling XSS.
  • →Shodan/FOFA fingerprinting: identify exposed Keycloak instances via favicon hash -1105083093 or HTML body/title containing 'Keycloak'.
  • ·The vulnerability requires Content-Type: application/json and is POST-only, limiting common browser-based exploitation paths without attacker-controlled infrastructure.
  • ·The XSS is exploitable across any realm on the Keycloak instance, not just the 'master' realm used in PoC paths.

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.