CVE-2023-5675 Quarkus: authorization flaw in quarkus resteasy reactive and classic
Attackers can bypass authorization on JAX-RS endpoints defined in abstract classes or extensions when specific security properties are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-5675?
CVE-2023-5675 is a medium-severity missing authorization vulnerability in Red Hat A-MQ Clients 2, published on 25 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
Weakness: CWE-285
Which versions are affected by CVE-2023-5675?
12 open source packages ship an affected version, including io.quarkus:quarkus-resteasy-reactive-common and io.quarkus:quarkus-resteasy-reactive-common-deployment.
| Package | Affected | Fixed in |
|---|---|---|
io.quarkus:quarkus-resteasy-reactive-common Maven | All versions | 3.2.10.Final |
io.quarkus:quarkus-resteasy-reactive-common Maven | All versions | 3.2.10.Final |
io.quarkus:quarkus-resteasy-reactive-common Maven | From 3.3.0 | 3.6.9 |
io.quarkus:quarkus-resteasy-reactive-common Maven | From 3.3.0 | 3.6.9 |
io.quarkus:quarkus-resteasy-reactive-common Maven | From 3.7.0 | 3.7.1 |
io.quarkus:quarkus-resteasy-reactive-common Maven | From 3.7.0 | 3.7.1 |
6 more packages
io.quarkus:quarkus-resteasy-reactive-common-deployment Maven | All versions | 3.2.10.Final |
io.quarkus:quarkus-resteasy-reactive-common-deployment Maven | All versions | 3.2.10.Final |
io.quarkus:quarkus-resteasy-reactive-common-deployment Maven | From 3.3.0 | 3.6.9 |
io.quarkus:quarkus-resteasy-reactive-common-deployment Maven | From 3.3.0 | 3.6.9 |
io.quarkus:quarkus-resteasy-reactive-common-deployment Maven | From 3.7.0 | 3.7.1 |
io.quarkus:quarkus-resteasy-reactive-common-deployment Maven | From 3.7.0 | 3.7.1 |
How do I fix CVE-2023-5675?
Upgrade io.quarkus:quarkus-resteasy-reactive-common to a fixed version for your release line: 3.2.10.Final, 3.6.9 or 3.7.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-5675 being exploited?
There is no known exploitation of CVE-2023-5675 in the wild and no public exploit code.
Sources
Also known as GHSA-25w4-hfqg-4r52.