External risk intelligence

Quarkus JSON Payload Processing Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-6267

The vulnerability exists in Quarkus, a framework commonly used to develop RESTful web services and APIs. Because these services are frequently deployed as internet-facing application endpoints to facilitate communication, the vulnerable code path—deserializing JSON payloads in REST resources—is commonly exposed to the public internet in typical real-world deployments.

Quarkus

before 2.13.93.0.0 to before 3.2.92.13.93.2.9

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A flaw exists in how certain REST resources process JSON data, specifically when annotation-based security is in use. This means sensitive information could be exposed before security checks are fully applied, potentially impacting data confidentiality and integrity. The main concern is confirming relevance and exposure within your environment.

Unchecked data processing before security applies.
Potential for unauthorized access to sensitive data.
Verify exposure and impact in your systems.

Attack Path

How an attacker could exploit the issue

An attacker could send a specially crafted JSON payload to a REST resource that uses annotation-based security. This payload would be processed before security checks are applied, potentially allowing unauthorized access or modification of data. This differs from configuration-based security, which evaluates security constraints before processing the payload.

Unauthenticated network access required.
Resource consumes JSON payload before security checks.
Leads to critical data compromise and modification.

Live Threat

Current exploitation, exposure, and threat context

When annotation-based security is used to protect a REST resource, the JSON data consumed by that resource may be processed before security rules are applied. This could allow an attacker to affect service behavior or sensitive information when supported by the advisory.

System data or service behavior.
Deserialization before security checks.
Service disruption or unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Quarkus impacts applications using annotation-based security for REST resources, where the JSON payload is processed before security checks. Application owners are responsible for identifying affected services, assessing their exposure and criticality, and coordinating remediation. The initial step involves discovering all instances of the vulnerable Quarkus version, confirming network reachability and business impact, and then engaging the appropriate teams for planning.

Application owners should own the issue.
Verify affected REST resource exposure.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Quarkus and what is it used for?

Quarkus is a Kubernetes-native Java framework designed for building high-performance applications and microservices. Developers use it to create efficient RESTful web services and APIs that run effectively in cloud-based environments.

How does CVE-2023-6267 affect security checks?

This vulnerability is an Improper Neutralization of Input During Web Page Generation or similar processing error, categorized as CWE-755. It occurs because the software deserializes, or unpacks, JSON data before verifying the user's permissions. Essentially, the application acts on the data provided by a user before it confirms if that user is allowed to access the resource.

Do I need specific triggers for this vulnerability?

Yes, the issue specifically occurs when your application uses annotation-based security to protect REST resources. If you use configuration-based security instead, the flaw is not triggered because those security constraints are correctly applied before the JSON payload is processed.

Is my application at risk if it uses Quarkus?

Halo Surface Signal indicates that because Quarkus is commonly used to build internet-facing RESTful APIs, this vulnerability often exists in exposed network paths. If your services are accessible from the public internet and use annotation-based security, they are more likely to be reachable by an attacker attempting to leverage this flaw.

When should I address this Quarkus vulnerability?

You should begin by identifying which services in your environment use annotation-based security and are running vulnerable versions of Quarkus. Once identified, prioritize these services based on their network reachability and business criticality, then coordinate with your development teams to apply the necessary updates during your next maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.