CVE-2023-4853: Quarkus Auth Bypass Vulnerability

CVE-2023-4853 Overview

CVE-2023-4853 is an authorization bypass vulnerability in Quarkus, the Kubernetes-native Java framework. The flaw resides in how Quarkus HTTP security policies sanitize incoming request paths. Certain character permutations are not normalized correctly before permission evaluation, allowing attackers to craft requests that bypass declared security constraints. Successful exploitation grants unauthorized access to protected endpoints and may trigger denial-of-service conditions. The vulnerability affects Quarkus upstream releases and multiple Red Hat products that embed Quarkus, including Red Hat build of Quarkus, Red Hat build of OptaPlanner, Camel K, Camel Quarkus, OpenShift Serverless, Process Automation Manager, and Decision Manager.

Critical Impact

Remote unauthenticated attackers can bypass HTTP security policies, accessing protected REST endpoints without credentials and potentially causing denial of service in Quarkus-based applications.

Affected Products

• Quarkus (multiple versions prior to patched releases)
• Red Hat build of Quarkus and Red Hat build of OptaPlanner 8.0
• Red Hat Integration Camel K, Camel Quarkus, and Service Registry
• Red Hat OpenShift Serverless, OpenShift Container Platform 4.10–4.12, Decision Manager 7.0, and Process Automation Manager 7.0

Discovery Timeline

• 2023-09-20 - CVE-2023-4853 published to the National Vulnerability Database
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-4853

Vulnerability Analysis

The weakness is classified as improper neutralization of equivalent special elements [CWE-148] combined with incorrect authorization [CWE-863]. Quarkus evaluates HTTP security policies by matching the request path against rules defined in application.properties under quarkus.http.auth.policy.* and quarkus.http.auth.permission.*. The matcher relies on a normalized path representation. When the incoming URI contains specific character permutations, the sanitizer fails to produce a canonical form before the policy engine evaluates the rule. The resulting mismatch causes the framework to apply a less restrictive policy than intended, or no policy at all. Attackers reach endpoints that should require authentication or specific roles.

Root Cause

The root cause is inconsistent path normalization between the HTTP routing layer and the security policy enforcement layer. Both layers must agree on how a request URI maps to a route. When Quarkus security policies parse certain encoded characters, trailing constructs, or repeated separators differently from the underlying Vert.x router, the same request resolves to two different paths. The security check passes against one path while the request handler dispatches against another.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker sends a crafted HTTP request to a Quarkus application protected by quarkus.http.auth.permission rules. By manipulating the request URI with specific character sequences, the attacker causes the policy engine to skip enforcement on an endpoint that the router still serves. No code is required beyond a standard HTTP client capable of issuing the malformed request path. Detailed proof-of-concept payloads are documented in the Red Hat Security Bulletin RHSB-2023-002 and Red Hat Bug Report #2238034.

Detection Methods for CVE-2023-4853

Indicators of Compromise

• HTTP access logs showing successful 200 responses on protected endpoints from clients that never completed authentication challenges.
• Request URIs containing unusual encoded characters, doubled path separators, or trailing delimiters targeting paths covered by quarkus.http.auth.permission rules.
• Anomalous spikes in requests to administrative or /q/ management endpoints from unauthenticated sources.

Detection Strategies

• Compare authentication events emitted by Quarkus security extensions with the set of routes that returned successful responses to identify mismatches.
• Deploy WAF rules that reject request paths containing non-canonical encodings before they reach the application.
• Enable Quarkus security audit logging via quarkus.security.events.enabled=true to capture authorization decisions for correlation.

Monitoring Recommendations

• Forward Quarkus and reverse proxy access logs to a centralized analytics platform and alert on unauthenticated access to role-protected endpoints.
• Baseline normal URI patterns per route and trigger alerts on outliers containing encoded slashes, semicolons, or duplicate separators.
• Monitor for sustained 4xx-to-2xx transitions on the same endpoint from a single source, which can indicate bypass probing.

How to Mitigate CVE-2023-4853

Immediate Actions Required

• Upgrade Quarkus to a patched release as identified in the upstream advisory and the corresponding Red Hat erratum for your distribution.
• Apply Red Hat updates for affected products through advisories RHSA-2023:5170, RHSA-2023:5310, RHSA-2023:5337, RHSA-2023:5446, RHSA-2023:5479, RHSA-2023:5480, RHSA-2023:6107, RHSA-2023:6112, and RHSA-2023:7653.
• Inventory all Quarkus-based services in production and staging, including embedded uses in Camel K, OpenShift Serverless, and Decision Manager.

Patch Information

Red Hat has issued patched packages across the affected product portfolio. Refer to the Red Hat CVE Details for CVE-2023-4853 for the authoritative list of fixed versions per product. Upstream Quarkus releases containing the path normalization fix should be applied to standalone deployments. Review the Red Hat Security Bulletin RHSB-2023-002 for cross-product remediation guidance.

Workarounds

• Place a reverse proxy or API gateway in front of Quarkus that performs strict URI canonicalization and rejects non-RFC-compliant paths.
• Tighten quarkus.http.auth.permission rules to use the most specific path matching available and avoid wildcard policies on sensitive endpoints.
• Require authentication globally and apply permit policies only to explicitly allow-listed public routes, reducing the blast radius of any path-matching mismatch.

# Example: enforce deny-by-default policy in application.properties
quarkus.http.auth.permission.deny-all.paths=/*
quarkus.http.auth.permission.deny-all.policy=authenticated
quarkus.http.auth.permission.public.paths=/public/*,/health
quarkus.http.auth.permission.public.policy=permit
quarkus.security.events.enabled=true