CVE-2023-4853: Quarkus: http security policy bypass
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Other sources
Quarkus could allow a remote attacker to bypass security restrictions, caused by improper sanitization of requests. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the security policy altogether.
— IBM
Quarkus using HTTP security policies was found to not sanitize certain character permutations correctly when accepting requests, resulting in problematic request resolution. An attacker could use this flaw to bypass the security policy altogether, resulting in unauthorized information or function access, and possibly even denial of service.
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-4853?
CVE-2023-4853 is a vulnerability in Quarkus that allows an attacker to bypass security policies and gain unauthorized access to endpoints.
How severe is CVE-2023-4853?
CVE-2023-4853 has a severity rating of 9.8 out of 10, indicating it is critical.
Which versions of Quarkus are affected by CVE-2023-4853?
Quarkus versions between 2.16.11 and 3.3.3 are affected by CVE-2023-4853.
How can I fix CVE-2023-4853?
To fix CVE-2023-4853, update Quarkus to version 3.3.3 or apply the appropriate patches provided by Red Hat.
Where can I find more information about CVE-2023-4853?
You can find more information about CVE-2023-4853 in the references section of the vulnerability report.