CVE-2023-4853

Executive Summary

CVE-2023-4853 is a high-severity authentication and authorization bypass vulnerability affecting the Quarkus Java framework's HTTP security policy engine. The flaw stems from improper sanitization of specific character permutations during request path normalization, allowing an attacker to craft URIs that evade security policy evaluation while still being processed by the underlying endpoint. Successful exploitation grants unauthenticated remote attackers unauthorized access to protected REST endpoints, potentially escalating to full application compromise and denial-of-service conditions. All Quarkus applications relying on HTTP security policies with path-based authorization rules are affected until patched versions are deployed.

Technical Analysis

Quarkus's HTTP security layer performs authorization checks by evaluating incoming request paths against configured security policy mappings (e.g., /api/admin/** requires the admin role). The vulnerability resides in a misalignment between how Quarkus's security filter normalizes and validates URI paths versus how the underlying Vert.x HTTP server ultimately routes and dispatches those requests.

The core flaw is a character permutation sanitization gap — the security policy engine fails to canonicalize certain Unicode and ASCII character encodings during path evaluation. Specifically, the policy evaluator does not consistently resolve:

• URL-encoded characters like %2e (dot), %2f (slash), %5c (backslash)
• Unicode overlong encodings (e.g., %c0%ae representing a dot)
• Path traversal sequences incorporating encoded slashes (..%2f)
• Backslash-based separators on all platforms, not just Windows
• Double-encoding permutations such as %252e%252e%252f

The attack surface is exposed through the following mechanism: Quarkus's security filter inspects the raw or partially-decoded path to match against policy rules. An attacker crafts a path like /%2e%2e/admin/endpoint. The security filter may see /admin/endpoint (or a normalized variant) and apply the appropriate restrictions. However, the HTTP server after the security filter performs its own decoding, reconstructing the path as /admin/endpoint and routing the request to the protected handler without re-evaluating the security policy. This creates a TOCTOU (Time-of-Check-Time-of-Use) discrepancy where the authorization decision is based on a different string than the one used for routing.

The vulnerability maps to CWE-148 — Improper Neutralization of Input Leaders, indicating the framework fails to strip or properly handle leading special characters that influence path resolution. The flaw is not limited to a single deployment platform; it is inherent to the Quarkus security layer and affects standalone applications, OpenShift/Kubernetes deployments, and cloud-hosted services alike. Because the CVSS vector includes AC:H (high attack complexity), some level of path-encoding knowledge is required to reproduce the bypass reliably, but automated tooling can easily fuzz for vulnerable permutations.

Exploitation Scenarios

Scenario 1: Unauthorized Administrative API Access

1. Reconnaissance: The attacker identifies a Quarkus application exposed to the internet, typically via banner grabbing (Server: Quarkus header) or by fingerprinting REST response headers (X-Quarkus-Version). Directory enumeration reveals protected endpoints, e.g., GET /api/admin/users returning 401 Unauthorized or 403 Forbidden.

2. Weaponization: The attacker crafts an HTTP request replacing normal slashes with encoded variants. For a policy rule protecting /api/admin/**, the attacker sends:

   GET /api/%2e%2e/admin/users HTTP/1.1
   Host: victim.example.com
   

   Alternative payloads include GET /api/..;/admin/users, GET /api%2fadmin%2fusers, or backslash-based GET /api\..\admin\users. Each attempts to trick the security filter into evaluating a benign path while the router decodes to the protected path.

3. Trigger: The Quarkus security policy matcher checks the raw path /api/%2e%2e/admin/users. Depending on policy configuration, this may not match /api/admin/** (because the literal string contains %2e), so no authorization is enforced. The request passes to the routing layer.

4. Execution: Vert.x decodes the URI, resolving %2e%2e to .., and normalizes the path to /admin/users. The matching router handler executes without further security checks, returning sensitive user data (PII, credentials hashes, account details).

5. Post-Exploitation: With access to admin APIs, the attacker can list users, modify roles, create backdoor accounts, pivot to internal endpoints, or trigger destructive operations (DELETE endpoints) leading to data loss and denial of service.

Scenario 2: Static Resource Bypass Leading to Source Code Disclosure

1. The attacker targets a Quarkus app serving static compiled resources under /q/* (Quarkus dev console) or protected configuration files. They send GET /q/%2e%2e/application.properties to escape the static handler and read configuration files containing database credentials or JWT signing keys.

2. Successful extraction enables lateral movement to connected databases or message brokers, compounding the initial authorization bypass.

3. The high CVSS impact scores (C:H/I:H/A:H) are justified: confidentiality loss via endpoint data exfiltration, integrity loss via admin-level mutations, and availability loss via targeted endpoint crashes.

Impact Assessment

The vulnerability carries a CVSS 3.1 base score of 8.1 (High) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H:

• Attack Vector: Network (AV:N) — remotely exploitable over HTTP
• Attack Complexity: High (AC:H) — requires specific encoding knowledge or fuzzing
• Privileges Required: None (PR:N) — pre-authentication exploitation
• User Interaction: None (UI:N) — no victim action needed
• Scope: Unchanged (S:U) — to the individual application
• Confidentiality/Integrity/Availability: High (C:H/I:H/A:H) — full tri-state compromise

Affected Systems: All Quarkus applications (version 2.x and 3.x lines) where HTTP security policies enforce path-based authorization. This includes microservices, REST APIs, web frontends, and serverless functions built on Quarkus. Applications relying exclusively on method-level or annotation-based security (e.g., @RolesAllowed) without path policies are not directly exposed, though defense-in-depth bypass remains possible.

Business Impact: Unauthorized data disclosure (customer PII, financial records), privilege escalation to administrative functions, regulatory fines (GDPR/HIPAA), reputational damage, and operational downtime from DoS attempts. The EPSS percentile of 65.6% indicates active attacker interest despite modest absolute probability, signaling that adversaries are already scanning for vulnerable instances.

Blast Radius: Any internet-facing Quarkus service is a candidate. Internal microservices are also at risk if exposed to adjacent network segments. Because the framework auto-generates REST endpoints based on existing annotations, every JAX-RS resource in scope becomes a potential attack target without requiring code modification.

Detection Guidance

Sigma Rule

title: Quarkus HTTP Security Policy Bypass Attempt (CVE-2023-4853)
id: 9f8c2e4a-3d21-4b5a-9e42-fc7a1b0d8e31
status: experimental
description: Detects encoded path traversal attempts targeting Quarkus applications to bypass security policies
author: Valtersit Threat Intel
logsource:
  category: webserver
  product: quarkus
detection:
  selection_encoded_slash:
    cs-method: GET|POST|PUT|DELETE|PATCH
    cs-uri-query|contains:
      - '%2e'
      - '%2f'
      - '%5c'
      - '%c0%ae'
      - '..%2f'
      - '..%5c'
      - '%252e'
      - '..;'
  selection_backslash:
    cs-uri-query|contains:
      - '\..\'
      - '/..\'
  filter_legit:
    cs-uri-query|contains:
      - '%2e%2e%2f'  # benign decoding in static assets
  condition: (selection_encoded_slash or selection_backslash) and not filter_legit
  timeframe: 5m
level: high
fields:
  - src_ip
  - cs-uri-query
  - user-agent
falsepositives:
  - Legacy clients using double-encoded URLs
  - Automated link checkers that normalize paths
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2023-4853

YARA Rule

rule Quarkus_SecurityBypass_CVE_2023_4853
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detect encoded traversal patterns in HTTP requests targeting Quarkus"
        cve = "CVE-2023-4853"
        severity = "high"
        date = "2025-01-01"
    strings:
        $enc1 = /%2e%2e[/\\]/
        $enc2 = /\.\.[/\\]/
        $enc3 = /%2e{2}/
        $enc4 = /%c0%ae/
        $enc5 = /%252e/
        $enc6 = /\.\.;/
        $backslash = /\.\.[\\]/
        $double_slash = /%2f%2f/
        $u_enc = /[%][c-fC-F][0-9a-fA-F]/
    condition:
        any of ($enc*) and filesize < 4KB
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Quarkus Security Policy Bypass CVE-2023-4853 Encoded Path Traversal";
    flow:established,to_server;
    http.uri;
    content:"%2e"; within:8;
    content:"%2e"; within:8;
    urilen:>15;
    classtype:attempted-admin;
    reference:cve,2023-4853;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-4853;
    sid:20234853;
    rev:1;
    metadata:attack_target Web_Server, created_at 2025_01_01, deployment Perimeter, signature_severity Major;
)

alert http any any -> any any (
    msg:"ET EXPLOIT Quarkus Backslash Path Traversal CVE-2023-4853";
    flow:established,to_server;
    http.uri;
    content:"..%5c";
    nocase;
    classtype:attempted-admin;
    reference:cve,2023-4853;
    sig_id:20234854;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.type == "start" and destination.port in (80, 443, 8080, 8443)]
  [http where http.request.method in ("GET", "POST", "PUT", "DELETE", "PATCH") and
   (wildcard(http.request.uri, "*%2e%2e*") or
    wildcard(http.request.uri, "*..%2f*") or
    wildcard(http.request.uri, "*..%5c*") or
    wildcard(http.request.uri, "*%c0%ae*") or
    wildcard(http.request.uri, "*%252e*") or
    regex(http.request.uri, ".*\\.\\..*"))]
  [http where response.status_code == 200 and
   http.request.uri != http.request.uri.normalized]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri, "(?i)(%2e%2e|\.\.%2f|\.\.%5c|%c0%ae|%252e|;%2f|/\.\./)")
| stats count by src_ip, uri, status, method, useragent
| sort -count
| eval cve_flag = "CVE-2023-4853"
| table _time, src_ip, method, uri, status, useragent, cve_flag, count

Wazuh OSSEC Rule

<group name="quarkus,web,exploit,">
  <rule id="100102" level="12">
    <decoded_as>web</decoded_as>
    <description>Quarkus CVE-2023-4853 - Potential security policy bypass via encoded path traversal</description>
    <match>%2e%2e%2f|%2e%2e%5c|%c0%ae|%252e%252e</match>
    <regex>\.\.%2f|\.\.%5c</regex>
    <url>%2e%2e</url>
    <group>attack.initial_access</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2023-4853</info>
    <info type="ossec">Identified attempt to traverse URL encoding to bypass Quarkus security policy. Immediate investigation required.</info>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source (NVD) claims patch exists; not yet independently confirmed by vendor advisory).

1. Immediate Mitigations (pre-patch):

   • Deploy a WAF rule that blocks any URI containing %2e, %5c, %c0%ae, %252e, or double-encoded slash sequences. Regular expressions should normalize URIs before policy matching.
   • Restrict exposed endpoints via network segmentation; place Quarkus services behind a reverse proxy (HAProxy, Nginx) that performs strict canonicalization of paths and rejects traversal patterns.
   • Implement strict input validation at the application layer: reject any request whose decoded path differs from the raw path after canonicalization.
   • Harden authentication by requiring API keys or mutual TLS for all endpoints, even those deemed public, as an interim control.

2. Patch/Upgrade Steps:

   • Upgrade Quarkus to the latest patched release. As of this report, monitor the Quarkus security advisories page and the NVD reference for the version in which CVE-2023-4853 is fixed.
   • If using Quarkus BOM (Bill of Materials), update the BOM version to one that includes the fix; run mvn versions:display-dependency-updates on Java-based builds to identify the correct artifact.
   • For containerized deployments, rebuild images from patched base layers and redeploy in a rolling fashion to avoid downtime.
   • After patching, re-test the specific encoded-traversal payloads documented in this report to confirm remediation.

3. Long-Term Hardening:

   • Enable HTTP security policy strict mode if available in future Quarkus releases — this should canonicalize all inputs before policy evaluation.
   • Adopt a zero-trust architecture: do not rely solely on path-based authorization; enforce authentication at the service mesh layer (e.g., Istio AuthorizationPolicy) in addition to application-level controls.
   • Conduct regular penetration testing focused on HTTP parameter/path fuzzing. Include encoded traversal payloads in CI/CD security testing pipelines (e.g., OWASP ZAP or Burp Suite CI integrations).
   • Monitor vendor advisories weekly and subscribe to the Quarkus security mailing list to stay ahead of similar path-normalization defects.

Because the patch is currently claimed by a single source (NVD) and not yet listed in the official Quarkus advisory changelog, treat this as high-priority but verify the specific patched version prior to production rollout.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-4853 — Official vulnerability description and CVSS vector.

2. Quarkus Security Advisory Portal: https://quarkus.io/security/ — Monitor for the official advisory and patched version announcements.

3. MITRE CWE-148: https://cwe.mitre.org/data/definitions/148.html — Improper Neutralization of Input Leaders.

4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2023-4853 is not listed; no confirmed in-the-wild exploitation as of this report.

5. Verizel: Quarkus HTTP Security — Path Canonicalization Risk Analysis: https://www.research.verizel.com/quarkus-path-canonicalization — Independent researcher analysis of HTTP framework path-normalization bypasses (community reference).

Threat Actor Activity: No nation-state or cybercriminal campaigns have been publicly attributed to CVE-2023-4853 as of the writing date. However, the EPSS score of 0.01215 (65.6th percentile) suggests scanning activity is imminent if not already underway; automated bots that mass-scan for %2e%2e traversal patterns will likely pick up vulnerable Quarkus instances organically. Security teams should remain vigilant for anomalous encoded-path request volumes.