CVE-2024-12225
📋 TL;DR
This vulnerability in Quarkus's WebAuthn module allows attackers to bypass authentication by accessing default REST endpoints that remain active even when custom endpoints are configured. Attackers can obtain login cookies for non-existent users or potentially log in as existing users by knowing their usernames. This affects Quarkus applications using the quarkus-security-webauthn module with custom REST endpoints.
💻 Affected Systems
- Quarkus
📦 What is this software?
Quarkus by Quarkus
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing attackers to log in as any existing user, potentially gaining administrative privileges and full control over the application.
Likely Case
Attackers can create unauthorized accounts or log in as existing users they can identify, leading to data theft, privilege escalation, or unauthorized actions.
If Mitigated
With proper endpoint configuration and access controls, the vulnerability is prevented, maintaining normal authentication flow.
🎯 Exploit Status
Exploitation requires only HTTP requests to default endpoints. No authentication needed. Attackers need to know or guess usernames for existing user login.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Quarkus security advisory for specific fixed versions
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2024-12225
Restart Required: Yes
Instructions:
1. Update Quarkus to patched version. 2. Update quarkus-security-webauthn dependency. 3. Restart application. 4. Verify default endpoints are properly disabled when custom endpoints are configured.
🔧 Temporary Workarounds
Disable default WebAuthn endpoints
allManually disable the default REST endpoints in application configuration when using custom endpoints
quarkus.webauthn.default-endpoints.enabled=false
Network access control
allRestrict access to WebAuthn endpoints using firewall rules or network segmentation
🧯 If You Can't Patch
- Implement application-level authentication checks before processing WebAuthn requests
- Use web application firewall (WAF) rules to block requests to default WebAuthn endpoints
🔍 How to Verify
Check if Vulnerable:
Check if application uses quarkus-security-webauthn module with custom REST endpoints configured while default endpoints remain accessible. Test by accessing /webauthn/register and /webauthn/login endpoints.Check Version:
Check Quarkus version in pom.xml or build.gradle, or run: java -jar your-app.jar --versionVerify Fix Applied:
After patching, verify that default endpoints return 404 or are properly disabled when custom endpoints are configured. Test authentication flow works correctly only through intended endpoints.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from same IP
- Successful logins from unexpected IPs or user agents
- Requests to /webauthn/register or /webauthn/login endpoints
Network Indicators:
- HTTP POST requests to default WebAuthn endpoints
- Unusual authentication traffic patterns
SIEM Query:
source="web_logs" AND (uri_path="/webauthn/register" OR uri_path="/webauthn/login") AND response_status=200