CVE-2023-6267: Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.
Other sources
If annotation based security is used to secure a REST resource, the JSON body the resource may consume is being processed (deserialized) prior to the security constraints being evaluated/applied.
This does not happen with configuration based security. Then security constraints are being evaluated/applied before a JSON body is being processed.
— Red Hat
Quarkus could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the json payload when annotation based security is used to secure a REST resource. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6267?
CVE-2023-6267 has been classified with a medium severity level due to the potential for security bypass in REST resources.
How do I fix CVE-2023-6267?
To fix CVE-2023-6267, upgrade to io.quarkus.resteasy.reactive version 3.2.9.Final or 2.13.9.Final or later.
What type of vulnerability is CVE-2023-6267?
CVE-2023-6267 is a deserialization vulnerability affecting the JSON payload processing in annotation based security.
Which versions of Quarkus are affected by CVE-2023-6267?
CVE-2023-6267 affects all versions of Red Hat Quarkus from 2.0.0 to 3.2.8 and includes specific versions like 2.13.9 and 3.2.9.
What is the impact of CVE-2023-6267?
The impact of CVE-2023-6267 includes potential unauthorized data access due to security constraints being evaluated after JSON deserialization.