Ideally wildcards are only used in dev/staging environments, but if the system allows for misconfiguration, the system will be misconfigured.","title":null,"type":"comment","url":null},{"author":"jdsleppy","children":[{"author":"pwntus_se","children":[],"created_at":"2024-01-13T08:06:06.000Z","created_at_i":1705133166,"id":38978112,"options":[],"parent_id":38975317,"points":null,"story_id":38964958,"text":"You could store that information in the client. Store a reference from the value of the state parameter to the deep link url you want.
https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1","title":null,"type":"comment","url":null}],"created_at":"2024-01-12T22:58:27.000Z","created_at_i":1705100307,"id":38975317,"options":[],"parent_id":38968587,"points":null,"story_id":38964958,"text":"I use it to allow a ?next={url} query parameter in the redirect so I can send users to the page they originally wanted to visit. It becomes more important the faster the access tokens expire because a user can reauth multiple times in a session.
The other way might be to put that URL in redis or something, maybe that's better?","title":null,"type":"comment","url":null}],"created_at":"2024-01-12T14:46:37.000Z","created_at_i":1705070797,"id":38968587,"options":[],"parent_id":38964958,"points":null,"story_id":38964958,"text":"> The vulnerability affects all OAuth 2.0 clients configured with a redirect URI ending with a * in Keycloak < 23.0.4.
How common is a wildcard in a redirect URL?","title":null,"type":"comment","url":null},{"author":"WirelessGigabit","children":[{"author":"pontushanssen","children":[],"created_at":"2024-01-12T17:22:02.000Z","created_at_i":1705080122,"id":38970928,"options":[],"parent_id":38970642,"points":null,"story_id":38964958,"text":"It was published 2024-01-11. The page has been updated to include the publish date. Thanks for the feedback!","title":null,"type":"comment","url":null}],"created_at":"2024-01-12T17:02:07.000Z","created_at_i":1705078927,"id":38970642,"options":[],"parent_id":38964958,"points":null,"story_id":38964958,"text":"Nitpick, but with security issues relevance is important. Relevant can be many things, and one of them is time.
If I see a blogpost from 2006 with a security issue it's probably not that relevant anymore.
When was this posted? I don't know. All I see is the CVE date.","title":null,"type":"comment","url":null},{"author":"apitman","children":[{"author":"marcosdumay","children":[{"author":"merb","children":[{"author":"marcosdumay","children":[],"created_at":"2024-01-13T03:31:57.000Z","created_at_i":1705116717,"id":38977089,"options":[],"parent_id":38972378,"points":null,"story_id":38964958,"text":"> redirect validation
This is an incredibly efficient footgun factory all by itself.","title":null,"type":"comment","url":null}],"created_at":"2024-01-12T19:02:27.000Z","created_at_i":1705086147,"id":38972378,"options":[],"parent_id":38971931,"points":null,"story_id":38964958,"text":"wildcard redirects are not kommen and the spec talks about redirect validation","title":null,"type":"comment","url":null}],"created_at":"2024-01-12T18:30:38.000Z","created_at_i":1705084238,"id":38971931,"options":[],"parent_id":38970929,"points":null,"story_id":38964958,"text":"My knee-jerk reaction would be to agree with that. But every single vulnerability I remember being announced for Keycloak was due to some footgun for the authentication protocol.
So, I do assess the risk of a less tested but simpler implementation being way higher than of a well tested complex one.
What leads to the obvious conclusion that it's best to avoid the protocol completely. But if you don't do that, I'd recommend using the mainstream software.","title":null,"type":"comment","url":null},{"author":"acdha","children":[],"created_at":"2024-01-12T20:12:16.000Z","created_at_i":1705090336,"id":38973320,"options":[],"parent_id":38970929,"points":null,"story_id":38964958,"text":"It\u2019s also how it\u2019s hosted: running as an enterprise Java app means you\u2019re getting a high/critical CVE every week for something you probably don\u2019t even use but which is bundled into something like Wildfly. Looking at it currently, I see SnakeYAML, the Apache SSHD, the H2 database, the Infinispan cache, etc. which are just generic Wildfly features and probably not even enabled, but you have to either be very confident about your ability to make that assertion or patching it frequently. This kind of service really needs to be lean and bundling only the dependencies it uses.","title":null,"type":"comment","url":null}],"created_at":"2024-01-12T17:22:03.000Z","created_at_i":1705080123,"id":38970929,"options":[],"parent_id":38964958,"points":null,"story_id":38964958,"text":"I made a (rather incomplete) comparision of various OpenID Connect server implementations[0]. Keycloak has over 1M lines of code. LOC isn't everything, but I don't know how you're supposed to avoid a decent number of serious vulnerabilities with that much surface area.
[0]: https://github.com/lastlogin-io/obligator#comparison-is-the-...","title":null,"type":"comment","url":null},{"author":"liminal","children":[],"created_at":"2024-01-12T18:16:25.000Z","created_at_i":1705083385,"id":38971738,"options":[],"parent_id":38964958,"points":null,"story_id":38964958,"text":"Does this exploit require the page with the specially crafted link to be on the host secured by Keycloak?","title":null,"type":"comment","url":null},{"author":"hsluoyz","children":[{"author":"KronisLV","children":[],"created_at":"2024-01-12T19:33:05.000Z","created_at_i":1705087985,"id":38972805,"options":[],"parent_id":38971885,"points":null,"story_id":38964958,"text":"> Keycloak was good but has too much legacy for 10+ years.
I got curious, actually seems to check out and explains why it's so well documented (but also complex and oftentimes confusing):
> The first production release of Keycloak was in September 2014, with development having started about a year earlier.
https://en.wikipedia.org/wiki/Keycloak
https://github.com/keycloak/keycloak/releases/tag/1.0.0.Fina...
It's kind of cool to see a project successfully survive for so long.","title":null,"type":"comment","url":null}],"created_at":"2024-01-12T18:26:54.000Z","created_at_i":1705084014,"id":38971885,"options":[],"parent_id":38964958,"points":null,"story_id":38964958,"text":"I'm using Casdoor: https://github.com/casbin/casdoor and glad to see it only has ~77,000 LOC according to the shared link.
Keycloak was good but has too much legacy for 10+ years. Casdoor is pretty new and has become a good replacement for Keycloak for me with more functionalities.","title":null,"type":"comment","url":null},{"author":"lakomen","children":[],"created_at":"2024-01-13T23:14:46.000Z","created_at_i":1705187686,"id":38985677,"options":[],"parent_id":38964958,"points":null,"story_id":38964958,"text":"If you configure a prod client with a wildcard redirect uri that's your fault. It has nothing to do with Keycloak.
If you configure a dev client with one, the prod backend won't accept this client.
So this is rather, "don't be stupid", than keycloak bad","title":null,"type":"comment","url":null}],"created_at":"2024-01-12T07:03:19.000Z","created_at_i":1705042999,"id":38964958,"options":[],"parent_id":null,"points":108,"story_id":38964958,"text":null,"title":"Keycloak open redirect: wildcard redirect URIs can be exploited to steal tokens","type":"story","url":"https://securityblog.omegapoint.se/en/writeup-keycloak-cve-2023-6027/"}