CVE-2023-4853: Quarkus: http security policy bypass

Q: What is CVE-2023-4853?

CVE-2023-4853 is a vulnerability in Quarkus that allows an attacker to bypass security policies and gain unauthorized access to endpoints.

Q: How severe is CVE-2023-4853?

CVE-2023-4853 has a severity rating of 9.8 out of 10, indicating it is critical.

Q: Which versions of Quarkus are affected by CVE-2023-4853?

Quarkus versions between 2.16.11 and 3.3.3 are affected by CVE-2023-4853.

Q: How can I fix CVE-2023-4853?

To fix CVE-2023-4853, update Quarkus to version 3.3.3 or apply the appropriate patches provided by Red Hat.

Q: Where can I find more information about CVE-2023-4853?

You can find more information about CVE-2023-4853 in the references section of the vulnerability report.

Published Sep 8, 2023

Updated

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Affected Software

34 affected componentsFixes available

redhat/openshift-serverless-clients<0:1.9.2-3.el8

0:1.9.2-3.el8

maven/io.quarkus:quarkus-keycloak-authorization>=3.3.0<3.3.3

3.3.3

maven/io.quarkus:quarkus-keycloak-authorization>=3.0.0<3.2.6.Final

3.2.6.Final

maven/io.quarkus:quarkus-keycloak-authorization<2.16.11.Final

2.16.11.Final

maven/io.quarkus:quarkus-csrf-reactive>=3.3.0<3.3.3

3.3.3

maven/io.quarkus:quarkus-csrf-reactive>=3.0.0<3.2.6.Final

3.2.6.Final

maven/io.quarkus:quarkus-csrf-reactive<2.16.11.Final

2.16.11.Final

maven/io.quarkus:quarkus-undertow>=3.3.0<3.3.3

3.3.3

maven/io.quarkus:quarkus-undertow>=3.0.0<3.2.6.Final

3.2.6.Final

maven/io.quarkus:quarkus-undertow<2.16.11.Final

2.16.11.Final

maven/io.quarkus:quarkus-vertx-http>=3.3.0<3.3.3

3.3.3

maven/io.quarkus:quarkus-vertx-http>=3.0.0<3.2.6.Final

3.2.6.Final

maven/io.quarkus:quarkus-vertx-http<2.16.11.Final

2.16.11.Final

Quarkus Quarkus<2.16.11

Quarkus Quarkus>=3.2.0<3.2.6

Quarkus Quarkus>=3.3.0<3.3.3

redhat Build Of Optaplanner=8.0

redhat Build Of Quarkus>=2.13.0<2.13.8

redhat Decision Manager=7.0

redhat Integration Camel K<1.10.2

redhat Integration Camel Quarkus

redhat Integration Service Registry

redhat Jboss Middleware=1

redhat Openshift Serverless

redhat Openshift Serverless=1.0

redhat Process Automation Manager=7.0

redhat Jboss Middleware Text-only Advisories Middleware=1.0

All of the following

Any of the following

redhat OpenShift Container Platform=4.10

redhat OpenShift Container Platform=4.11

redhat OpenShift Container Platform=4.12

redhat Enterprise Linux=8.0

redhat/quarkus<2.16.11.

2.16.11.

redhat/quarkus<3.2.6.

3.2.6.

redhat/quarkus<3.3.3

3.3.3

Remediation

Information

Use a ‘deny’ wildcard for base paths, then authenticate specifics within that: Examples: ``` deny: /* authenticated: /services/* ``` or ``` deny: /services/* roles-allowed: /services/rbac/* ``` NOTE: Products are only vulnerable if they use (or allow use of) path-based HTTP policy configuration. Products may also be affected–shipping the component in question–without being vulnerable (“affected at reduced impact”). See https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 for more detailed mitigations.

Event History

Sep 8, 2023

CVE Published

12:00 AM

Data Sourced

via Red Hat·04:29 PM

DescriptionSeverityAffected Software

Sep 20, 2023

CVE Published

via MITRE·09:47 AM

Data Sourced

via MITRE·09:47 AM

DescriptionSeverityWeakness

Advisory Published

12:30 PM

Dec 13, 2023

Data Sourced

via IBM·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is CVE-2023-4853?

CVE-2023-4853 is a vulnerability in Quarkus that allows an attacker to bypass security policies and gain unauthorized access to endpoints.

How severe is CVE-2023-4853?

CVE-2023-4853 has a severity rating of 9.8 out of 10, indicating it is critical.

Which versions of Quarkus are affected by CVE-2023-4853?

Quarkus versions between 2.16.11 and 3.3.3 are affected by CVE-2023-4853.

How can I fix CVE-2023-4853?

To fix CVE-2023-4853, update Quarkus to version 3.3.3 or apply the appropriate patches provided by Red Hat.

Where can I find more information about CVE-2023-4853?

You can find more information about CVE-2023-4853 in the references section of the vulnerability report.

CVE-2023-4853: Quarkus: http security policy bypass

Affected Software

Remediation

Information

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2023-4853?

How severe is CVE-2023-4853?

Which versions of Quarkus are affected by CVE-2023-4853?

How can I fix CVE-2023-4853?

Where can I find more information about CVE-2023-4853?

Company

Resources

Contact