CVE-2019-14837 (published 2020-01-07T17:15Z)

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-798
cwe_name: Use of Hard-coded Credentials
description: The product contains hard-coded credentials, such as a password or cryptographic key.
extended_description: 
		   There are two main variations:
		   
			 Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect.
			 Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.
		   
         
         

Fix information:
repo_url: https://github.com/keycloak/keycloak
commit_details: repo_url: https://github.com/keycloak/keycloak
author: Stefan Guilhen
author_date: 2019-10-25 11:46:27-03:00
msg: KEYCLOAK-10780 Stop creating placeholder e-mails for service accounts (#228)
repository: repo_url: https://github.com/keycloak/keycloak
repo_name: keycloak/keycloak
description: Open Source Identity and Access Management For Modern Applications and Services
repo_language: Java
owner: keycloak
file_changes: filename: testrealm.json
change_type: ModificationType.MODIFY
diff: @@ -76,7 +76,6 @@
         {
             "username" : "service-account-product-sa-client",
             "enabled": true,
-            "email" : "service-account-product-sa-client@placeholder.org",
             "serviceAccountClientId": "product-sa-client",
             "realmRoles": [ "user" ]
         }

programming_language: JavaScript
filename: ClientManager.java
change_type: ModificationType.MODIFY
diff: @@ -164,7 +164,6 @@ public class ClientManager {
             // Don't use federation for service account user
             UserModel user = realmManager.getSession().userLocalStorage().addUser(client.getRealm(), username);
             user.setEnabled(true);
-            user.setEmail(username + "@placeholder.org");
             user.setServiceAccountClientLink(client.getId());
         }
 
@@ -205,7 +204,6 @@ public class ClientManager {
         if (serviceAccountUser != null) {
             String username = ServiceAccountConstants.SERVICE_ACCOUNT_USER_PREFIX + newClientId;
             serviceAccountUser.setUsername(username);
-            serviceAccountUser.setEmail(username + "@placeholder.org");
         }
     }
 

programming_language: Java
filename: photoz-realm.json
change_type: ModificationType.MODIFY
diff: @@ -111,7 +111,6 @@
     {
       "username": "service-account-photoz-restful-api",
       "enabled": true,
-      "email": "service-account-photoz-restful-api@placeholder.org",
       "serviceAccountClientId": "photoz-restful-api",
       "clientRoles": {
         "photoz-restful-api" : ["uma_protection"]

programming_language: JavaScript
filename: ClientTest.java
change_type: ModificationType.MODIFY
diff: @@ -231,6 +231,8 @@ public class ClientTest extends AbstractAdminTest {
         response.close();
         UserRepresentation userRep = realm.clients().get(id).getServiceAccountUser();
         assertEquals("service-account-serviceclient", userRep.getUsername());
+        // KEYCLOAK-11197 service accounts are no longer created with a placeholder e-mail.
+        assertNull(userRep.getEmail());
     }
 
     // KEYCLOAK-3421

programming_language: Java