CVE-2023-4853: Quarkus: http security policy bypass
First published: Fri Sep 08 2023(Updated: )
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openshift-serverless-clients | <0:1.9.2-3.el8 | 0:1.9.2-3.el8 |
| Quarkus Quarkus | <2.16.11 | |
| Quarkus Quarkus | >=3.2.0<3.2.6 | |
| Quarkus Quarkus | >=3.3.0<3.3.3 | |
| Redhat Build Of Optaplanner | =8.0 | |
| Redhat Build Of Quarkus | >=2.13.0<2.13.8 | |
| Redhat Decision Manager | =7.0 | |
| Redhat Integration Camel K | <1.10.2 | |
| Redhat Integration Camel Quarkus | ||
| Redhat Integration Service Registry | ||
| Redhat Jboss Middleware | =1 | |
| Redhat Openshift Serverless | ||
| Redhat Openshift Serverless | =1.0 | |
| Redhat Process Automation Manager | =7.0 | |
| maven/io.quarkus:quarkus-keycloak-authorization | >=3.3.0<3.3.3 | 3.3.3 |
| maven/io.quarkus:quarkus-keycloak-authorization | >=3.0.0<3.2.6.Final | 3.2.6.Final |
| maven/io.quarkus:quarkus-keycloak-authorization | <2.16.11.Final | 2.16.11.Final |
| maven/io.quarkus:quarkus-csrf-reactive | >=3.3.0<3.3.3 | 3.3.3 |
| maven/io.quarkus:quarkus-csrf-reactive | >=3.0.0<3.2.6.Final | 3.2.6.Final |
| maven/io.quarkus:quarkus-csrf-reactive | <2.16.11.Final | 2.16.11.Final |
| maven/io.quarkus:quarkus-undertow | >=3.3.0<3.3.3 | 3.3.3 |
| maven/io.quarkus:quarkus-undertow | >=3.0.0<3.2.6.Final | 3.2.6.Final |
| maven/io.quarkus:quarkus-undertow | <2.16.11.Final | 2.16.11.Final |
| maven/io.quarkus:quarkus-vertx-http | >=3.3.0<3.3.3 | 3.3.3 |
| maven/io.quarkus:quarkus-vertx-http | >=3.0.0<3.2.6.Final | 3.2.6.Final |
| maven/io.quarkus:quarkus-vertx-http | <2.16.11.Final | 2.16.11.Final |
| redhat/quarkus | <2.16.11. | 2.16.11. |
| redhat/quarkus | <3.2.6. | 3.2.6. |
| redhat/quarkus | <3.3.3 | 3.3.3 |
| <2.16.11 | ||
| >=3.2.0<3.2.6 | ||
| >=3.3.0<3.3.3 | ||
| =8.0 | ||
| >=2.13.0<2.13.8 | ||
| =7.0 | ||
| <1.10.2 | ||
| =1 | ||
| =1.0 | ||
| =1.0 | ||
| =7.0 | ||
| All of | ||
| Any of | ||
| =4.10 | ||
| =4.11 | ||
| =4.12 | ||
| =8.0 |
Remedy
Use a ‘deny’ wildcard for base paths, then authenticate specifics within that: Examples: ``` deny: /* authenticated: /services/* ``` or ``` deny: /services/* roles-allowed: /services/rbac/* ``` NOTE: Products are only vulnerable if they use (or allow use of) path-based HTTP policy configuration. Products may also be affected–shipping the component in question–without being vulnerable (“affected at reduced impact”). See https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 for more detailed mitigations.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-4853
- https://access.redhat.com/errata/RHSA-2023:5170
- https://access.redhat.com/errata/RHSA-2023:5310
- https://access.redhat.com/security/cve/CVE-2023-4853
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-002
- https://bugzilla.redhat.com/show_bug.cgi?id=2238034
- https://github.com/quarkusio/quarkus/issues/35785
- https://access.redhat.com/errata/RHSA-2023:5337
- https://github.com/quarkusio/quarkus/discussions/35940
- https://access.redhat.com/errata/RHSA-2023:5446
- https://access.redhat.com/errata/RHSA-2023:5479
- https://access.redhat.com/errata/RHSA-2023:5480
- https://access.redhat.com/articles/11258
- https://access.redhat.com/errata/RHSA-2023:6107
- https://access.redhat.com/errata/RHSA-2023:6112
- https://access.redhat.com/errata/RHSA-2023:7653
- https://github.com/advisories/GHSA-4f4r-wgv2-jjvg (Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/266748
- https://www.ibm.com/support/pages/node/7096365 (Advisory)
- https://www.cve.org/CVERecord?id=CVE-2023-4853 https://nvd.nist.gov/vuln/detail/CVE-2023-4853
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2023-4853?
CVE-2023-4853 is a vulnerability in Quarkus that allows an attacker to bypass security policies and gain unauthorized access to endpoints.
How severe is CVE-2023-4853?
CVE-2023-4853 has a severity rating of 9.8 out of 10, indicating it is critical.
Which versions of Quarkus are affected by CVE-2023-4853?
Quarkus versions between 2.16.11 and 3.3.3 are affected by CVE-2023-4853.
How can I fix CVE-2023-4853?
To fix CVE-2023-4853, update Quarkus to version 3.3.3 or apply the appropriate patches provided by Red Hat.
Where can I find more information about CVE-2023-4853?
You can find more information about CVE-2023-4853 in the references section of the vulnerability report.
- collector/redhat-cve
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-4f4r-wgv2-jjvg
- alias/CVE-2023-4853
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/first-publish-date
- collector/ibm-support
- source/IBM
- agent/weakness
- agent/references
- agent/author
- agent/remedy
- agent/title
- agent/severity
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/softwarecombine
- agent/event
- agent/tags
- agent/trending
- package-manager/redhat
- vendor/quarkus
- canonical/quarkus quarkus
- version/quarkus quarkus/3.2.0
- version/quarkus quarkus/3.3.0
- vendor/redhat
- canonical/redhat build of optaplanner
- version/redhat build of optaplanner/8.0
- canonical/redhat build of quarkus
- version/redhat build of quarkus/2.13.0
- canonical/redhat decision manager
- version/redhat decision manager/7.0
- canonical/redhat integration camel k
- canonical/redhat integration camel quarkus
- canonical/redhat integration service registry
- canonical/redhat jboss middleware
- version/redhat jboss middleware/1
- canonical/redhat openshift serverless
- version/redhat openshift serverless/1.0
- canonical/redhat process automation manager
- version/redhat process automation manager/7.0
- package-manager/maven
- canonical/redhat jboss middleware text-only advisories middleware
- version/redhat jboss middleware text-only advisories middleware/1.0
- canonical/redhat openshift container platform
- version/redhat openshift container platform/4.10
- version/redhat openshift container platform/4.11
- version/redhat openshift container platform/4.12
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0