Repository navigation
How to prevent phishing injections in error_description on Keycloak pages? #41862
Replies: 1 comment 1 reply
Please follow https://www.keycloak.org/security to report suspected security issues - cc @keycloak/cloud-native
I don't believe there is. Is the issue here more that the text is not displayed by default in such a way to clarify this is an error message? cc @keycloak/ui |
The issue is that it displays any user supplied editable content from a query parameter. It's encoded so there's not XSS or anything but phishing attempts can bounce fake websites (even if they're not "links") or phone numbers on the page to trick users. The link itself is a legitimate domain - so it will be allowed through any filters that verify domains - and the users may trust the displayed content because it's a legit site that they know. So in the phone number example, if a user is tricked into calling a fake support number that malicious person already has some legitimacy as the user got the number from their site; so they may already be more willing comply to their requests. They can then use that to gain further access or collect sensitive PII asking them to confirm their Identity; such as chaining that abuse with a known Device Code Flow applications (e.g., Email) that I convince the user to go to this company URL (which is legit) and enter their "support code" to re-enable the account. Once they follow through with that I then get the tokens due to the weak OAuth Device Code Flow. While the likelihood might be Low the impact could be High depending on what the user has access to. |
Uh oh!
There was an error while loading. Please reload this page.
Going through Keycloak there's places like the account console where any text is accepted in error_description.
This leads to a phishing pathway if someone is sent a crafted URL with fake support phone numbers or URLs, such as /realms/test-realm/account?error=problem&error_description=Your+account+is+disabled+call+1-800-malicious+for+help
While it's encoded, the information can be displayed in a way to trick users into calling a number thinking it's trusted due to it being "on the page".
I can't have any page accepting user input values without validating against a known good list.
Is there somewhere centralized I can get that in place easily without having to touch a lot of stuff?
All reactions