CVE-2025-1247: Quarkus REST Information Disclosure Flaw

CVE-2025-1247 Overview

A critical vulnerability has been identified in Quarkus REST that allows request parameters to leak between concurrent requests when endpoints use field injection without a proper CDI (Contexts and Dependency Injection) scope. This flaw, classified under CWE-488 (Exposure of Data Element to Wrong Session), enables attackers to manipulate request data, impersonate users, or gain unauthorized access to sensitive information processed by vulnerable Quarkus REST applications.

The vulnerability stems from improper session handling in the Quarkus REST framework, where field-injected request parameters may persist and leak across different user sessions during concurrent request processing. This creates a race condition scenario where one user's request data becomes accessible to another user's session.

Critical Impact

Attackers can exploit this vulnerability to manipulate request data, impersonate legitimate users, or access sensitive information belonging to other users through concurrent request parameter leakage.

Affected Products

• Quarkus REST (versions prior to patched releases)
• Red Hat build of Quarkus (see RHSA-2025:1884, RHSA-2025:1885, RHSA-2025:2067)
• Applications using field injection without CDI scope in REST endpoints

Discovery Timeline

• February 13, 2025 - CVE-2025-1247 published to NVD
• March 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-1247

Vulnerability Analysis

The vulnerability exists in how Quarkus REST handles field injection for request parameters when endpoints are implemented without specifying a CDI scope. In Java EE and Jakarta EE applications, CDI scopes such as @RequestScoped, @SessionScoped, or @ApplicationScoped define the lifecycle and visibility of managed beans. When a REST endpoint uses field injection (via @Inject or parameter annotations like @QueryParam, @PathParam) without declaring an appropriate scope, the framework may reuse bean instances across multiple concurrent requests.

This architectural flaw creates a window where request parameters from one user's HTTP request can be read by another user's concurrent request handler. The attack surface is particularly dangerous in high-concurrency environments where multiple users interact with the same REST endpoints simultaneously.

Root Cause

The root cause is classified as CWE-488: Exposure of Data Element to Wrong Session. When Quarkus REST endpoints use field injection without an explicit CDI scope annotation, the injected field values are not properly isolated between concurrent requests. The framework fails to properly scope the lifecycle of injected request parameters, allowing data from one session to leak into another session's execution context.

This occurs because without a CDI scope, the endpoint class may be treated as a singleton or use an improper default scope, causing field values to be shared across request threads rather than being isolated per-request.

Attack Vector

The attack exploits the network-accessible REST endpoints with relatively low complexity requirements. An authenticated attacker with low privileges can send carefully timed concurrent requests to vulnerable endpoints. Due to the field injection leak, the attacker's request may receive parameter values intended for another user's request, or conversely, the attacker's malicious parameters may be processed in another user's security context.

The exploitation scenario involves an attacker identifying REST endpoints that use field injection without proper CDI scoping. By sending concurrent requests with specific timing, the attacker can cause their injected parameters to leak into another user's request processing, potentially allowing:

• Access to sensitive data from other users' requests
• Impersonation by having their session process another user's authentication context
• Data manipulation by injecting parameters into another user's transaction

Detection Methods for CVE-2025-1247

Indicators of Compromise

• Unexpected parameter values appearing in application logs during request processing
• Users reporting seeing other users' data intermittently in application responses
• Inconsistent request behavior that varies based on server load and concurrency levels
• Authentication or authorization anomalies where actions are attributed to wrong users

Detection Strategies

• Review application code for REST endpoints using field injection (@Inject, @QueryParam, @PathParam, @HeaderParam) without CDI scope annotations (@RequestScoped, @Dependent)
• Monitor application logs for parameter value inconsistencies across concurrent requests
• Implement request correlation IDs and audit trails to detect cross-session data access
• Deploy application security testing tools to identify endpoints vulnerable to session data leakage

Monitoring Recommendations

• Enable detailed request logging including correlation IDs to track parameter values across the request lifecycle
• Implement anomaly detection for user behavior patterns that indicate session mixing or data leakage
• Monitor concurrent request metrics and correlate spikes with data integrity issues
• Establish baseline request patterns and alert on deviations that may indicate exploitation attempts

How to Mitigate CVE-2025-1247

Immediate Actions Required

• Apply the latest security patches from Red Hat advisories RHSA-2025:1884, RHSA-2025:1885, and RHSA-2025:2067
• Audit all Quarkus REST endpoints for field injection usage without CDI scope declarations
• Add @RequestScoped or @Dependent annotations to all REST resource classes using field injection
• Review and test all REST endpoints under concurrent load conditions to verify parameter isolation

Patch Information

Red Hat has released security advisories addressing this vulnerability. Organizations using Quarkus REST should apply the patches referenced in the following advisories:

• RHSA-2025:1884 - Red Hat build of Quarkus security update
• RHSA-2025:1885 - Red Hat build of Quarkus security update
• RHSA-2025:2067 - Red Hat build of Quarkus security update

Additional details are available in Red Hat Bug Report #2345172 and the Red Hat CVE Details page.

Workarounds

• Add explicit @RequestScoped annotation to all REST resource classes that use field injection to ensure proper request isolation
• Refactor REST endpoints to use constructor injection or method parameter injection instead of field injection where possible
• Implement request-scoped wrapper services for handling sensitive request parameters
• Consider using @Dependent scope for stateless REST resources that require per-injection instance creation

# Example: Adding RequestScoped annotation to REST endpoints
# Review all REST resource files and ensure proper CDI scope
grep -r "@Path" src/main/java --include="*.java" | \
  xargs -I {} grep -L "@RequestScoped\|@Dependent" {} | \
  while read file; do
    echo "WARNING: $file may need CDI scope annotation"
  done