Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- quarkus-vertx-http
Version range not reported
- quarkus-vertx-http
Version range not reported
- devspaces/multicluster-redirector-rhel9
Version range not reported
- exploit-intelligence/agent-client-rhel9
Version range not reported
- openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9
Version range not reported
- openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9
Version range not reported
- openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9
Version range not reported
- openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9
Version range not reported
- openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9
Version range not reported
- openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9
Version range not reported
- openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9
Version range not reported
- openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9
Version range not reported
- quarkus-vertx-http
Version range not reported
- quarkus-vertx-http
Version range not reported
- quarkus-vertx-http
Version range not reported
- keycloak/rhbk-openshift-rhel9
Version range not reported
- keycloak/rhbk-rhel9-operator
Version range not reported
- quarkus-vertx-http
Version range not reported
- rhbk/keycloak-rhel9
Version range not reported
- rhbk/keycloak-rhel9-operator
Version range not reported
- quarkus-vertx-http
Version range not reported
- rhoai/odh-trustyai-service-rhel9
Version range not reported