Area
Keycloak Ssf
Describe the bug
PII or payload-specific sensitive data can be persisted in admin events despite the
code's stated data-minimization requirement.
Version
Current development branch at the time of analysis.
Regression
Unknown.
Expected behavior
Remove eventData from the admin event representation or replace it with bounded, non-
sensitive metadata such as event type, subject reference, status, and jti.
Actual behavior
A trusted emitter or receiver-managing admin submits an SSF event whose nested event
body includes sensitive identity data. Keycloak stores that request body in admin-event
representation data, extending access to anyone or anything with admin-event read/export
access and retaining payloads longer than the SSF delivery path requires.
Affected code:
ssf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.java
How to Reproduce?
Proof evidence:
- type:
focused test
- test:
emit_persistsVerbatimEventPayloadInAdminEventRepresentation
- result:
passed
- file:
ssf/tests/base/src/test/java/org/keycloak/tests/ssf/transmitter/SsfTransmitterEventEmitterTests.java
./mvnw -DskipProtoLock=true -pl ssf/tests/base -Dtest=SsfTransmitterEventEmitterTests#emit_persistsVerbatimEventPayloadInAdminEventRepresentation test
Evidence
| File |
Lines |
Detail |
ssf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.java |
964-1045 |
The trusted-emitter endpoint accepts synthetic SSF event bodies from receiver-approved callers. |
ssf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.java |
1183-1187 |
The local security comment says the audit representation deliberately should not include the verbatim event body because it may contain PII and arbitrary data. |
ssf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.java |
1203-1218 |
createEmitEventAuditRepresentation adds request.getEvent() as eventData when the event body is present. |
Supporting evidence.
Affected Components
ssf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.java
Evidence
| File |
Lines |
Detail |
ssf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.java |
964-1045 |
The trusted-emitter endpoint accepts synthetic SSF event bodies from receiver-approved callers. |
ssf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.java |
1183-1187 |
The local security comment says the audit representation deliberately should not include the verbatim event body because it may contain PII and arbitrary data. |
ssf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.java |
1203-1218 |
createEmitEventAuditRepresentation adds request.getEvent() as eventData when the event body is present. |
Attack Path
A trusted emitter or receiver-managing admin submits an SSF event whose nested event
body includes sensitive identity data. Keycloak stores that request body in admin-event
representation data, extending access to anyone or anything with admin-event read/export
access and retaining payloads longer than the SSF delivery path requires.
Impact
PII or payload-specific sensitive data can be persisted in admin events despite the
code's stated data-minimization requirement.
Recommendation
Remove eventData from the admin event representation or replace it with bounded, non-
sensitive metadata such as event type, subject reference, status, and jti.
Area
Keycloak Ssf
Describe the bug
PII or payload-specific sensitive data can be persisted in admin events despite the
code's stated data-minimization requirement.
Version
Current development branch at the time of analysis.
Regression
Unknown.
Expected behavior
Remove eventData from the admin event representation or replace it with bounded, non-
sensitive metadata such as event type, subject reference, status, and jti.
Actual behavior
A trusted emitter or receiver-managing admin submits an SSF event whose nested event
body includes sensitive identity data. Keycloak stores that request body in admin-event
representation data, extending access to anyone or anything with admin-event read/export
access and retaining payloads longer than the SSF delivery path requires.
Affected code:
How to Reproduce?
Proof evidence:
focused testemit_persistsVerbatimEventPayloadInAdminEventRepresentationpassedssf/tests/base/src/test/java/org/keycloak/tests/ssf/transmitter/SsfTransmitterEventEmitterTests.java./mvnw -DskipProtoLock=true -pl ssf/tests/base -Dtest=SsfTransmitterEventEmitterTests#emit_persistsVerbatimEventPayloadInAdminEventRepresentation testEvidence
ssf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.javassf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.javassf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.javaSupporting evidence.
Affected Components
ssf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.javaEvidence
ssf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.javassf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.javassf/services/src/main/java/org/keycloak/ssf/services/admin/SsfAdminResource.javaAttack Path
A trusted emitter or receiver-managing admin submits an SSF event whose nested event
body includes sensitive identity data. Keycloak stores that request body in admin-event
representation data, extending access to anyone or anything with admin-event read/export
access and retaining payloads longer than the SSF delivery path requires.
Impact
PII or payload-specific sensitive data can be persisted in admin events despite the
code's stated data-minimization requirement.
Recommendation
Remove eventData from the admin event representation or replace it with bounded, non-
sensitive metadata such as event type, subject reference, status, and jti.