CVE-2023-6394
📋 TL;DR
CVE-2023-6394 is an authentication bypass vulnerability in Quarkus where GraphQL operations over WebSocket connections are processed without proper role-based permission checks, even when endpoints are configured as secured. This allows attackers to access restricted information and functionality without authentication. Organizations using Quarkus with GraphQL WebSocket endpoints and role-based security are affected.
💻 Affected Systems
- Quarkus
📦 What is this software?
Quarkus by Quarkus
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to sensitive data and administrative functionality through GraphQL operations, potentially leading to data exfiltration, privilege escalation, or system compromise.
Likely Case
Unauthenticated users access GraphQL operations they shouldn't have permission to execute, potentially exposing sensitive business data or performing unauthorized actions.
If Mitigated
With proper network segmentation and additional authentication layers, impact is limited to specific GraphQL endpoints, though unauthorized access to those endpoints remains possible.
🎯 Exploit Status
Exploitation requires WebSocket access to GraphQL endpoints and knowledge of available GraphQL operations. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Quarkus 2.16.6.Final or 3.2.4.Final
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2023-6394
Restart Required: Yes
Instructions:
1. Update Quarkus to version 2.16.6.Final or 3.2.4.Final. 2. Update dependencies in pom.xml or build.gradle. 3. Rebuild and redeploy application. 4. Restart affected services.
🔧 Temporary Workarounds
Disable GraphQL WebSocket endpoints
allTemporarily disable GraphQL WebSocket functionality until patching is possible
quarkus.smallrye-graphql.websocket.enabled=false
Add explicit role annotations
allAdd @RolesAllowed annotations to all GraphQL operations to enforce authentication
@RolesAllowed("authenticated") // Add to each GraphQL resolver method
🧯 If You Can't Patch
- Implement network-level WebSocket filtering to restrict access to GraphQL WebSocket endpoints
- Add application-level authentication checks before processing GraphQL operations
🔍 How to Verify
Check if Vulnerable:
Check if Quarkus version is below 2.16.6.Final or 3.2.4.Final and GraphQL WebSocket endpoints are enabled with role-based securityCheck Version:
java -jar your-application.jar --version | grep -i quarkusVerify Fix Applied:
Verify Quarkus version is 2.16.6.Final or 3.2.4.Final or higher, then test that GraphQL WebSocket operations now require proper authentication📡 Detection & Monitoring
Log Indicators:
- Unauthenticated WebSocket connections to GraphQL endpoints
- GraphQL operations executed without authentication logs
Network Indicators:
- WebSocket traffic to /graphql endpoints without authentication headers
- Unusual GraphQL query patterns from unauthenticated sources
SIEM Query:
websocket AND graphql AND (NOT authenticated OR auth_failed:false)🔗 References
- https://access.redhat.com/errata/RHSA-2023:7612
- https://access.redhat.com/errata/RHSA-2023:7700
- https://access.redhat.com/security/cve/CVE-2023-6394
- https://bugzilla.redhat.com/show_bug.cgi?id=2252197
- https://access.redhat.com/errata/RHSA-2023:7612
- https://access.redhat.com/security/cve/CVE-2023-6394
- https://bugzilla.redhat.com/show_bug.cgi?id=2252197
