REDHAT-BUG-2265158: Low severity Quarkus Quarkus vulnerability
Description: Security checks for standard security annotations on the RESTEasy Reactive inherited endpoints are not performed eagerly, but are performed by standard security interceptors instead. Apart from functional differences it also means security checks for inherited endpoints are not performed eagerly.
As long as you know any POST / PUT / PATCH request paths, you can send unauthenticated HTTP requests with illegal payload and see response status. When you get 500 ... this way you detect endpoints (though there can be other reasons...) Can you significantly raise processing time? You can send valid content which means requests will be stopped after JAX-RS filters. Resulting impact depends on what they do in JAX-RS filters.
Affected Quarkus version: 999-SNAPSHOT, 3.8.x. 3.7.x, 3.2.x, 2.13.x
Mitigations with affected version: Don't use inherited endpoints (or use HTTP permissions, depending on the scenario)
References: https://github.com/quarkusio/quarkus/pull/38832 https://github.com/quarkusio/quarkus/issues/38754
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Avoid relying on inherited REST endpoints; instead use direct endpoints (or apply HTTP permissions as appropriate for the scenario) to prevent unauthenticated requests from reaching paths that can be probed when security checks are not performed eagerly on inherited endpoints.
Quarkus RESTEasy Reactive (JAX-RS) Use of inherited endpoints = Do not use inherited endpoints (or use HTTP permissions, depending on scenario)
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2265158?
The severity of REDHAT-BUG-2265158 relates to improper security checks in inherited endpoints in RESTEasy Reactive, which could lead to security vulnerabilities.
How do I fix REDHAT-BUG-2265158?
To fix REDHAT-BUG-2265158, upgrade to a patched version of Red Hat Quarkus that addresses the security check issue.
What versions of Red Hat Quarkus are affected by REDHAT-BUG-2265158?
Red Hat Quarkus versions from 2.13.0 to 3.8.x are affected by REDHAT-BUG-2265158.
What are the functional implications of REDHAT-BUG-2265158?
The functional implication of REDHAT-BUG-2265158 is that inherited endpoints may not have security checks performed as expected, increasing the risk of unauthorized access.
Are there any recommended practices to mitigate the risk of REDHAT-BUG-2265158?
Recommended practices to mitigate the risk of REDHAT-BUG-2265158 include conducting regular security audits and ensuring the application is updated to the latest secure versions.