CVE-2023-6267 Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.

What is CVE-2023-6267?

CVE-2023-6267 is a high-severity unsafe deserialization vulnerability in Red Hat Fuse 7, published on 25 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.

Weakness: CWE-755

Which versions are affected by CVE-2023-6267?

4 open source packages ship an affected version, including io.quarkus.resteasy.reactive:resteasy-reactive. It affects 1 product.

Products include Quarkus Quarkus.

How do I fix CVE-2023-6267?

Upgrade io.quarkus.resteasy.reactive:resteasy-reactive to a fixed version for your release line: 2.13.9.Final or 3.2.9.Final.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2023-6267 being exploited?

There is no known exploitation of CVE-2023-6267 in the wild and no public exploit code.

Other vulnerabilities in Red Hat Fuse 7

• CVE-2022-4116 Code injection in quarkus dev ui config editor Critical 9.8
• CVE-2022-2466 Quarkus does not terminate HTTP requests header context Critical 9.8
• CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass Critical 9.1
• CVE-2026-39852 Quarkus authorization bypass via semicolon path normalization inconsistency High 8.8
• CVE-2022-0981 Privilege escalation in quarkus High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8j3x-w35r-rw4r.