ElianGonzi00

GitHub · Repository owner · Source ID 79408142
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

ElianGonzi00/pocKeycloakCVE-2023-0264

Repository PoC0Created 2026-07-28ExploitCVE-2023-02647 files

16.8 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Docker-based front-end application that executes the OIDC authorization code flow against a Keycloak instance and implements a session hijacking mechanism by allowing an attacker to substitute the session_id obtained from a victim's request, which is the core of CVE-2023-0264.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Dockerfile, a README, and a shell script for a proof-of-concept (PoC) front-end for CVE-2023-0264. The files describe a legitimate OIDC session hijacking demonstration tool. No concealed executable behavior, deceptive payloads, persistence mechanisms, credential theft, or unrelated remote access were observed. The shell script generates a configuration file from environment variables, which is standard practice. The README explicitly states the tool is for authorized testing on the user's own Keycloak instance.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesShellDockerfile
Target softwareKeycloak
Attack typesSession HijackingAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is explicitly described as a 'PoC' that 'exposes the session_id hijacking hook' and allows a user to 'substitute' a session_id, which is the active exploitation of CVE-2023-0264, not just detection or scanning.

README.md:1README.md:3-4README.md:38-40

Requirements

  • Requires a running Keycloak instance with a specific realm and client configured, and the attacker must be able to obtain a victim's session_id.README.md:20-28README.md:38-39

Observed behavior

  • Serves a static web page that initiates an OIDC login flow to a Keycloak instance.README.md:3-4README.md:37
  • After the OIDC redirect, a prompt allows the user to view and replace the current session_id with a different one, enabling session hijacking.README.md:38-40
  • The application's configuration (Keycloak URL, realm, client ID) is dynamically generated at container startup from environment variables.docker-entrypoint.d/40-poc-config.sh:2-4docker-entrypoint.d/40-poc-config.sh:11-16
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Default Keycloak Url
Payload withheldThe shell script sets a default Keycloak URL pointing to a specific IP address. This is a configuration default, not a backdoor, and is overridable via environment variables.docker-entrypoint.d/40-poc-config.sh:7
Review boundaries

What the analysis did not establish

  • The main application logic (index1.html) is not included in the provided text files, so the exact client-side code for the session_id substitution cannot be analyzed.
  • The evidence only includes the Dockerfile, README, and a shell script; the core exploit code is missing.
  • Four files in the repository (total 7 files) were not included in the text evidence; their content is unknown. The analysis scope covers only the three provided text files.
  • The actual HTML/JavaScript front-end code (index1.html) is not included in the evidence, so its runtime behavior cannot be verified.
  • No binary files were analyzed; the binary policy is metadata-only.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.