CVE-2022-4147: Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed

Background

The Quarkus Vert.x HTTP package is an open-source library that provides support for building reactive applications in Java. It offers a lightweight and efficient runtime for developing cloud-native microservices. The package includes a CORS (Cross-Origin Resource Sharing) filter that allows or restricts cross-origin requests based on specified rules. CORS is an important security mechanism that prevents malicious websites from making unauthorized requests to a server. However, a vulnerability has been discovered in the Quarkus CORS filter that allows simple GET and POST requests with an invalid Origin to proceed, bypassing the intended security restrictions.

Vulnerability Detail

The vulnerability in the Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed. This means that an attacker can send requests from a different domain than the one allowed by the server, potentially leading to unauthorized access or data leakage. The issue specifically affects simple GET or POST requests made with XMLHttpRequest, which are requests that have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request. The vulnerability has a CVSS score of 7.5, indicating a high severity level.

Workaround

If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by manually validating the Origin header in the application code. This can be done by checking the value of the Origin header in each incoming request and comparing it against a whitelist of allowed origins. If the Origin header is found to be invalid or not present, the request should be rejected or handled accordingly. Here is an example of how this validation can be implemented in Java using the Quarkus framework:

import io.vertx.ext.web.handler.CorsHandler;

CorsHandler corsHandler = CorsHandler.create()
    .allowOrigin("https://example.com")
    .allowMethods(HttpMethod.GET, HttpMethod.POST);

// Apply the CORS handler to the desired routes
router.route().handler(corsHandler);

In this example, the allowOrigin method is used to specify the allowed origin(s) as a whitelist. Requests with an invalid or unauthorized origin will be rejected.

Conclusion

The Quarkus Vert.x HTTP package is vulnerable to a security issue that allows simple GET and POST requests with an invalid Origin to proceed. This can potentially lead to unauthorized access or data leakage. It is crucial for developers to upgrade to a fixed version of the package (2.14.2.Final or 2.13.5.Final) to mitigate the vulnerability. If immediate upgrading is not possible, implementing a manual validation of the Origin header can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for io.quarkus:quarkus-vertx-http →

FAQ