CVE-2022-4147 Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed

What is CVE-2022-4147?

CVE-2022-4147 is a high-severity vulnerability in quarkus-2, published on 6 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

Weakness: CWE-1026

Which versions are affected by CVE-2022-4147?

4 open source packages ship an affected version, including io.quarkus:quarkus-vertx-http. It affects 1 product.

Products include Quarkus Quarkus.

How do I fix CVE-2022-4147?

Upgrade io.quarkus:quarkus-vertx-http to a fixed version for your release line: 2.13.5.Final or 2.14.2.Final.

Is CVE-2022-4147 being exploited?

There is no known exploitation of CVE-2022-4147 in the wild and no public exploit code.

Other vulnerabilities in quarkus-2

• CVE-2022-4116 Code injection in quarkus dev ui config editor Critical 9.8
• CVE-2022-2466 Quarkus does not terminate HTTP requests header context Critical 9.8
• CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass Critical 9.1
• CVE-2026-39852 Quarkus authorization bypass via semicolon path normalization inconsistency High 8.8
• CVE-2022-0981 Privilege escalation in quarkus High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9895-g6x5-xwcp.