Keycloak SAML Broker Endpoint Encrypted Assertion Validation Vulnerability

A vulnerability exists in Keycloak's SAML broker endpoint, specifically in the Red Hat build of Keycloak. The issue arises because the endpoint fails to properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this flaw by crafting a malicious SAML response that injects an encrypted assertion for an arbitrary principal. This exploitation could lead to unauthorized access and potential information disclosure.

Impact

Exploitation of this vulnerability allows for unauthorized access by injecting encrypted assertions for arbitrary principals, bypassing normal authentication controls. This could also result in unauthorized information access.

Reproduction

To reproduce this vulnerability, an attacker must first obtain a valid signed SAML assertion. The attacker can then craft a SAML response by removing the signature from the response (if present) and encrypting a new assertion using the public key of the target realm. This crafted response is then sent to Keycloak, which, due to the improper validation, will accept the injected encrypted assertion as legitimate.

Remediation

Users can upgrade to the Red Hat build of Keycloak 26.2.14 or 26.4.10, both of which include the necessary fix for this vulnerability.