CVE-2023-5675: Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
Other sources
Quarkus could allow a remote attacker to bypass security restrictions, caused by improper authorization validation when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass access restrictions.
— IBM
When a RestEasy Reactive JAX-RS endpoint has its methods with HTTP method annotations declared in the abstract Java class or when its methods without HTTP method annotations are customised by Quarkus extensions to handle JAX-RS GET requests using the annotation processor, then the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties
So a combination of 2 factors triggers it: Users enable the security authorization of JAX-RS endpoints with either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or quarkus.security.jaxrs.default-roles-allowed properties Users declare JAX-RS methods which must be secured with these properties in the Java abstract class which the JAX-RS endpoint class will extend
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5675?
CVE-2023-5675 is considered a critical security vulnerability in Quarkus.
How do I fix CVE-2023-5675?
To fix CVE-2023-5675, update Quarkus to version 3.7.1 for both quarkus-resteasy-reactive-common and quarkus-resteasy-reactive-common-deployment.
Which versions of Quarkus are affected by CVE-2023-5675?
CVE-2023-5675 affects Quarkus versions 3.3.0 to 3.7.0 for the packages io.quarkus:quarkus-resteasy-reactive-common and io.quarkus:quarkus-resteasy-reactive-common-deployment.
What are the consequences of CVE-2023-5675?
The consequences of CVE-2023-5675 include the potential failure to enforce authorization on specified JAX-RS methods, which may lead to unauthorized access.
Is there a workaround available for CVE-2023-5675?
There are no known workarounds for CVE-2023-5675; updating to the latest version is recommended.