# Is Keycloak affected by the Spring Core RCE vulnerability?

**URL:** https://forum.keycloak.org/t/is-keycloak-affected-by-the-spring-core-rce-vulnerability/14678
**Category:** Configuring the server
**Created:** [March 31, 2022, 12:34pm UTC](https://forum.keycloak.org/t/is-keycloak-affected-by-the-spring-core-rce-vulnerability/14678 "2022-03-31T12:34:00Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![brease-colin](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/brease-colin/32/5471_2.png) [@brease-colin](https://forum.keycloak.org/u/brease-colin)
#### Post date: [March 31, 2022, 12:34pm UTC](https://forum.keycloak.org/t/is-keycloak-affected-by-the-spring-core-rce-vulnerability/14678/1 "2022-03-31T12:34:00Z")

</div>

I believe Spring (Boot) is used in the sourcecode. See details about the vulnerability here: [Spring4Shell: Security Analysis of the latest Java RCE '0-day' vulnerabilities in Spring | LunaSec](https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/)

And if so, which parts are affected, any workarounds / fixes?

---

<div class="post-metadata">

### Author: ![rables](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rables/32/5491_2.png) [@rables](https://forum.keycloak.org/u/rables)
#### Post date: [April 1, 2022, 3:25pm UTC](https://forum.keycloak.org/t/is-keycloak-affected-by-the-spring-core-rce-vulnerability/14678/2 "2022-04-01T15:25:02Z")

</div>

I came here looking for the same information. No one from Keycloak can reply after two days?

---

<div class="post-metadata">

### Author: ![JanetPost](https://avatars.discourse-cdn.com/v4/letter/j/b782af/32.png) [@JanetPost](https://forum.keycloak.org/u/JanetPost)
#### Post date: [April 1, 2022, 4:00pm UTC](https://forum.keycloak.org/t/is-keycloak-affected-by-the-spring-core-rce-vulnerability/14678/3 "2022-04-01T16:00:27Z")

</div>

Yes, Keycloak is vulnerable.

I am using the docker image which was updated 2 months ago.

I used this script: [GitHub - cybersecurityworks553/spring4shell-detect](https://github.com/cybersecurityworks553/spring4shell-detect)

Remember to point at the form for authentication for your url. You will get a false result otherwise:

* * *

$ python3 detect\_v2.py --url [http://127.0.0.1:8080/auth/realms/master/protocol/openid-connect/auth](http://127.0.0.1:8080/auth/realms/master/protocol/openid-connect/auth) --post  
[\<\>] Testing for Spring4Shell…!

Using POST Method  
[+] Vulnerable!

* * *

I am not sure what the fix is currently. ☹

---

<div class="post-metadata">

### Author: ![ktwe](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ktwe/32/5495_2.png) [@ktwe](https://forum.keycloak.org/u/ktwe)
#### Post date: [April 1, 2022, 5:32pm UTC](https://forum.keycloak.org/t/is-keycloak-affected-by-the-spring-core-rce-vulnerability/14678/4 "2022-04-01T17:32:23Z")

</div>

The “vulnerability test” of this script is very basic. It simply checks if the server response with “400 Bad Request” to mark it as vulnerable. Since the exploit code doesn’t make any sense for Keycloak it correctly answers with a 400 status code. It does so also when you send some other nonsense to this endpoint. So this doesn’t proof Keycloak to be affected.

---

<div class="post-metadata">

### Author: ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)
#### Post date: [April 1, 2022, 6:09pm UTC](https://forum.keycloak.org/t/is-keycloak-affected-by-the-spring-core-rce-vulnerability/14678/5 "2022-04-01T18:09:24Z")

</div>

Keycloak is not based on Spring at all!

There are only some adapters FOR Spring, but they are outdated, deprecated and out of any support.