CVE-2024-5967 — Keycloak: leak of configured ldap bind credentials through the keycloak admin console
A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credent…
Published: 2024-06-18 · CVSS: 2.7 · CVSS 3.1
A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permission manage-realm) to change the LDAP host URL ("Connection URL") to a machine they control. The Keycloak server will connect to the attacker's host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console or compromised a user with sufficient privileges can leak domain credentials and attack the domain.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7