Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

SQL injection false positives with Keycloak SSO?

LD | Last updated: Apr 05, 2023 02:40PM UTC

Testing with the latest release of BurpSuite Pro against an instance of Keycloak 16, I get a number of reports of "SQL injection" issues. However, when looking at the response HTML I see no indication of any errors, which is simply the normal SSO login page. Checking application logs, I'm seeing no indications of errors as well. Exporting the requests as curl commands yield identical results: calls to the APIs, which get 302 redirected to the login page. My only guess is that an inline SVG in the response might be tripping up the scanner. I can supply both sanitized request and response documents to show the test/results, but I don't see a way to directly attach files.

LD | Last updated: Apr 05, 2023 06:11PM UTC

As an update, we've deployed a version that does not contain the inline SVG in the login page, but we're seeing identical results. It's perplexing.

Ben, PortSwigger Agent | Last updated: Apr 06, 2023 07:59AM UTC