CVE-2023-6394 Quarkus: graphql operations over websockets bypass

What is CVE-2023-6394?

CVE-2023-6394 is a high-severity missing authorization vulnerability in Red Hat build of Quarkus, published on 9 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.

Weakness: CWE-862

Which versions are affected by CVE-2023-6394?

4 open source packages ship an affected version, including io.quarkus:quarkus-smallrye-graphql-client. It affects 2 products.

Products include Quarkus Quarkus, Redhat Build of Quarkus.

How do I fix CVE-2023-6394?

Upgrade io.quarkus:quarkus-smallrye-graphql-client to a fixed version for your release line: 2.13.9.Final or 3.5.3.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-6394 being exploited?

There is no known exploitation of CVE-2023-6394 in the wild and no public exploit code.

Other vulnerabilities in Red Hat build of Quarkus

• CVE-2022-4116 Code injection in quarkus dev ui config editor Critical 9.8
• CVE-2022-2466 Quarkus does not terminate HTTP requests header context Critical 9.8
• CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass Critical 9.1
• CVE-2026-39852 Quarkus authorization bypass via semicolon path normalization inconsistency High 8.8
• CVE-2022-0981 Privilege escalation in quarkus High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mvc8-6ffp-jrx5.