This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Keycloak forces server to call unverified URLs via OIDC `request_uri`. <br>๐ฅ **Consequences**: Enables **Server-Side Request Forgery (SSRF)**.โฆ
๐ก๏ธ **CWE**: **CWE-918** (SSRF). <br>๐ **Flaw**: Lack of validation on the URL provided in the `request_uri` parameter. The server blindly trusts and fetches this external input.
Q3Who is affected? (Versions/Components)
๐ฆ **Product**: Red Hat **Keycloak**. <br>๐ **Affected**: Versions **12.0.1 and below**. <br>๐ข **Vendor**: Red Hat (USA).
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Hackers Can**: Perform **Blind SSRF**. <br>๐ **Impact**: Port scan localhost, access internal hosts, or bypass network restrictions using the Keycloak server as a proxy.
Q5Is exploitation threshold high? (Auth/Config)
โก **Threshold**: **LOW**. <br>๐ **Auth**: **Unauthenticated**. No login required to trigger the vulnerability via the OIDC parameter.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฃ **Public Exp?**: **YES**. <br>๐ **PoC**: Available on GitHub (`ColdFusionX/Keycloak-12.0.1-CVE-2020-10770`) and Exploit-DB (**50405**). Python script provided.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for Keycloak instances. <br>๐งช **Test**: Send malicious OIDC `request_uri` payloads. <br>๐ **Tool**: Use Nuclei templates (`CVE-2020-10770.yaml`) for automated detection.
Q8Is it fixed officially? (Patch/Mitigation)
๐ฉน **Official Fix**: **YES**. <br>๐ **Status**: Red Hat acknowledged (Bugzilla #1846270). Users should upgrade to a patched version immediately.
Q9What if no patch? (Workaround)
๐ง **No Patch?**: Implement strict **URL allowlisting** for `request_uri`. <br>๐ **Block**: Prevent Keycloak from making outbound requests to internal/private IP ranges via firewall rules.
Q10Is it urgent? (Priority Suggestion)
โ ๏ธ **Urgency**: **HIGH**. <br>๐ฅ **Reason**: Unauthenticated SSRF allows easy network reconnaissance and potential data exfiltration. Patch ASAP!