CVE-2023-0264

MEDIUM

Keycloak vulnerable to user impersonation via stolen UUID code

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-0264 has a selected CVSS score of 5.0 (medium); EIP currently links 2 repository PoCs and 1 lab environment.

Description

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2
Lab environments
1

Affected products and versions

2
ProductSourceVersion range

Keycloak

Browse redhat.com / Keycloak

Default status: unaffected

CVE List18.0.6 to < 18.0.6affected

org.keycloak:keycloak-services

Browse Maven / org.keycloak:keycloak-services
GitHub AdvisoryBefore 21.0.1 · Fixed in 21.0.1affected

Proofs of concept

2

Repository PoCs

GitHubElianGonzi00/pocKeycloakCVE-2023-0264Repository PoCby ElianGonzi000Exploit7 files

16.8 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Docker-based front-end application that executes the OIDC authorization code flow against a Keycloak instance and implements a session hijacking mechanism by allowing an attacker to substitute the session_id obtained from a victim's request, which is the core of CVE-2023-0264.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Dockerfile, a README, and a shell script for a proof-of-concept (PoC) front-end for CVE-2023-0264. The files describe a legitimate OIDC session hijacking demonstration tool. No concealed executable behavior, deceptive payloads, persistence mechanisms, credential theft, or unrelated remote access were observed. The shell script generates a configuration file from environment variables, which is standard practice. The README explicitly states the tool is for authorized testing on the user's own Keycloak instance.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesShellDockerfile
Target softwareKeycloak
Attack typesSession HijackingAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is explicitly described as a 'PoC' that 'exposes the session_id hijacking hook' and allows a user to 'substitute' a session_id, which is the active exploitation of CVE-2023-0264, not just detection or scanning.

README.md:1README.md:3-4README.md:38-40

Requirements

  • Requires a running Keycloak instance with a specific realm and client configured, and the attacker must be able to obtain a victim's session_id.README.md:20-28README.md:38-39

Observed behavior

  • Serves a static web page that initiates an OIDC login flow to a Keycloak instance.README.md:3-4README.md:37
  • After the OIDC redirect, a prompt allows the user to view and replace the current session_id with a different one, enabling session hijacking.README.md:38-40
  • The application's configuration (Keycloak URL, realm, client ID) is dynamically generated at container startup from environment variables.docker-entrypoint.d/40-poc-config.sh:2-4docker-entrypoint.d/40-poc-config.sh:11-16
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Default Keycloak Url
Payload withheldThe shell script sets a default Keycloak URL pointing to a specific IP address. This is a configuration default, not a backdoor, and is overridable via environment variables.docker-entrypoint.d/40-poc-config.sh:7
Review boundaries

What the analysis did not establish

  • The main application logic (index1.html) is not included in the provided text files, so the exact client-side code for the session_id substitution cannot be analyzed.
  • The evidence only includes the Dockerfile, README, and a shell script; the core exploit code is missing.
  • Four files in the repository (total 7 files) were not included in the text evidence; their content is unknown. The analysis scope covers only the three provided text files.
  • The actual HTML/JavaScript front-end code (index1.html) is not included in the evidence, so its runtime behavior cannot be verified.
  • No binary files were analyzed; the binary policy is metadata-only.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubtwwd/CVE-2023-0264Repository PoCby twwd7Not analyzed8 files

156.6 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

ElianGonzi00/pocKeycloakCVE-2023-0264Created Vuln labCVE-2023-0264Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-service Docker Compose environment that builds and runs a static front-end PoC for CVE-2023-0264 (OIDC session hijacking). The front-end is served by nginx:alpine on port 5174 and connects to an external Keycloak instance at 147.93.70.139:8443.

docker-compose.yml:1-18Dockerfile:1-14README.md:1-50

Lab assessment

Vulnerability lab

The README explicitly describes the unit as a PoC for CVE-2023-0264, detailing the session-hijacking hook and the required Keycloak configuration. The Dockerfile and Compose file serve a static front-end that implements the OIDC authorization code flow with a prompt to substitute the session ID, which is the core of the demonstrated vulnerability.

README.md:1-50index1.html:220-250
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

poc-cve-0264

vulnerable PoC front-endOIDC clientsession-hijacking demonstrator

A container built from nginx:alpine that serves a static HTML/JS application. The application implements the OIDC authorization code flow against a Keycloak instance, and includes a preInitHook that prompts the user to replace the session_id in the authorization code, demonstrating CVE-2023-0264. Keycloak connection parameters are injected at runtime via a generated config.js.

docker-compose.yml:6-17Dockerfile:1-14index1.html:220-250docker-entrypoint.d/40-poc-config.sh:1-19
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-0264

Supported by supplied evidence

The README and the index1.html code explicitly describe and implement a session-hijacking hook that allows substituting the session_id in the OIDC authorization code, which matches the description of CVE-2023-0264 (Keycloak session hijacking via code injection).

README.md:1-50index1.html:220-250
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A running Keycloak instance accessible at https://147.93.70.139:8443 with realm 'poc' and client 'client1' configured with valid redirect URIs and web origins for the PoC front-end.README.md:15-24docker-compose.yml:13-15
  • The user must accept the self-signed certificate of the Keycloak instance in their browser before using the PoC.README.md:26-29
  • The host running the PoC must have Docker and Docker Compose installed, and port 5174 must be reachable by the user's browser.README.md:7-12

Evidence-described exercise path

  1. Start the PoC front-end with 'docker compose up -d --build'.README.md:7-9
  2. Open http://maquina:5174 in a browser; the application redirects to the Keycloak login page.README.md:31-32index1.html:300-320
  3. After authentication, Keycloak redirects back with an authorization code in the URL fragment. The preInitHook parses the code, extracts the session_id, and prompts the user to replace it with a target session ID.index1.html:220-250README.md:32-34
  4. If a new session ID is provided, the code is modified and the page reloads with the hijacked session, completing the token exchange and demonstrating the vulnerability.index1.html:240-250README.md:34-36
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the intended lab target: the PoC front-end connects to the specified external Keycloak instance to demonstrate the session-hijacking vulnerability. There is no evidence of host escape, persistence, credential theft, data destruction, unexplained payloads, or backdoor behavior. The port mapping (5174:80) and environment variables are necessary for the lab's operation.

docker-compose.yml:1-18Dockerfile:1-14index1.html:1-367docker-entrypoint.d/40-poc-config.sh:1-19
Review boundaries

What the analysis did not establish

  • The packet does not include the 'agente/' directory referenced in the README, so the detection component is absent.
  • The Keycloak instance at 147.93.70.139:8443 is external and not part of the supplied evidence; its configuration and safety cannot be assessed.
  • The Docker Compose file uses 'restart: unless-stopped', which could keep the container running across reboots, but this is a common operational choice and not inherently malicious.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

5