Security Research

CVE-2020-10770 Keycloak SSRF: One OIDC Parameter Exposes Internal Servers

#Vulnerability Analysis#Code Audit#Lateral Movement
Identity provider turned into SSRF proxy via OIDC parameter

A single OIDC parameter — request_uri — is enough to turn Keycloak into a proxy. With no proper validation, any URL the attacker controls becomes a request Keycloak will fire for them.

Unlock to view this content.