CVE-2022-1245
📋 TL;DR
This vulnerability allows a client application with a valid access token to exchange tokens for any target client by specifying the target's client_id, bypassing authorization checks. This could enable unauthorized access to additional services. All Keycloak deployments using token exchange are affected.
💻 Affected Systems
- Keycloak
📦 What is this software?
Keycloak by Redhat
⚠️ Risk & Real-World Impact
Worst Case
An attacker could gain access to all services integrated with the Keycloak instance, potentially leading to full system compromise and data exfiltration.
Likely Case
An authenticated but low-privileged client could escalate privileges to access sensitive services or data they shouldn't have access to.
If Mitigated
With proper network segmentation and least-privilege access controls, impact would be limited to the compromised client's scope.
🎯 Exploit Status
Exploitation requires a valid access token but is straightforward once obtained. Public proof-of-concept code exists in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.0.0 and later
Vendor Advisory: https://github.com/keycloak/keycloak/security/advisories/GHSA-75p6-52g3-rqc8
Restart Required: Yes
Instructions:
1. Upgrade Keycloak to version 18.0.0 or later. 2. Restart the Keycloak service. 3. Verify the fix by testing token exchange functionality.
🔧 Temporary Workarounds
Disable Token Exchange
allTemporarily disable the token exchange feature if not required.
Set 'token-exchange' feature to disabled in Keycloak configuration
Restrict Client Permissions
allApply strict client authorization policies to limit token exchange capabilities.
Configure client policies to restrict 'token-exchange' scope
🧯 If You Can't Patch
- Implement network segmentation to isolate Keycloak from critical services
- Enable detailed logging and monitoring for token exchange activities
🔍 How to Verify
Check if Vulnerable:
Check if Keycloak version is below 18.0.0 and token exchange feature is enabled.Check Version:
Check Keycloak admin console or server logs for version informationVerify Fix Applied:
After upgrading to 18.0.0+, test token exchange with unauthorized client_id to confirm it's blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual token exchange requests
- Token exchanges between unrelated clients
- Failed authorization attempts for token exchange
Network Indicators:
- Abnormal token exchange API calls
- Unexpected client_id parameters in token requests
SIEM Query:
source="keycloak" AND (event="TOKEN_EXCHANGE" OR message="token exchange") AND NOT client_id IN [authorized_clients]