A vulnerability was found in Quarkus REST Data Panache where the sort query parameter is not properly validated on non paged collection endpoints. When a resource is explicitly configured with ResourceProperties paged equals false, the code generator ListMethodImplementor fails to apply the standard SortQueryParamValidator to the generated list method. This allows the underlying database engine to process arbitrary sort fields. An attacker can exploit this to perform side channel attacks to infer sensitive information or provide complex non indexed fields to force expensive sorting operations, leading to a denial of service.

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.

Title: Missing Authorization in Quarkus REST Data Panache via Dropped Security Annotations Summary:

A vulnerability in the Quarkus REST Data Panache code generator allows unauthenticated attackers to access improperly secured generated endpoints. When a developer applies a class-level @ResourceProperties(rolesAllowed = ...) annotation to secure a resource, but customizes a specific operation using @MethodProperties without explicitly re-declaring the security roles, the code generator silently drops the class-level security requirement for that specific method. This causes the affected endpoint to default to permissive, unauthenticated access.

Component: io.quarkus:quarkus-hibernate-orm-rest-data-panacheCWE: CWE-285, CWE-862 Scoring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1/10) Affected versions: 3.27, 3.33

Credit: Michael Read (https://github.com/Michael-JRead)