CVE-2024-12225

Overview

Quarkus is a Kubernetes-native Java framework optimized for cloud-native applications, containers, and serverless workloads. It is designed around fast startup, low memory use, build-time processing, and developer-friendly integrations across REST, HTTP, security, data, messaging, and observability extensions.

An Authorization Bypass vulnerability (CVE-2024-12225) has been identified in Quarkus WebAuthn, which allows attackers to complete authentication through the framework's default callback endpoint even when an application provides custom REST endpoints for WebAuthn login or registration. This can allow an attacker to obtain a login cookie outside the application's intended user-binding flow and, depending on the application, impersonate an existing user by username.

Per OWASP, authentication-bypass testing analyzes how authentication works and uses that information to circumvent the authentication mechanism.

This issue affects multiple versions of Quarkus WebAuthn in the io.quarkus:quarkus-security-webauthn package.

‍

Details

Module Info

• Product: Quarkus
• Affected packages: io.quarkus:quarkus-security-webauthn
• Affected versions: >=2.9.0.CR1 <3.8.6.1, >=3.9.0.CR1 <3.15.3.1, >=3.16.0.CR1 <3.18.0.CR1
• GitHub repository: https://github.com/quarkusio/quarkus
• Published packages: https://central.sonatype.com/artifact/io.quarkus/quarkus-security-webauthn
• Package manager: Maven
• Fixed in: NES for Quarkus 2.16.x

Vulnerability Info

This Critical-severity vulnerability is found in the io.quarkus:quarkus-security-webauthn package in multiple versions of Quarkus. Quarkus WebAuthn provides built-in REST endpoints for obtaining login and registration challenges and for completing the WebAuthn ceremony. Applications can also provide custom REST endpoints when they need to attach WebAuthn credentials to application-specific users, create accounts, update credential counters, or perform additional authorization checks.

The vulnerable route setup registers the default callback endpoint unconditionally:

router.post(prefix + "webauthn/login").handler(bodyHandler).handler(controller::login);
router.post(prefix + "webauthn/register").handler(bodyHandler).handler(controller::register);
router.post(prefix + "webauthn/callback").handler(bodyHandler).handler(controller::callback);
router.get(prefix + "webauthn/webauthn.js").handler(controller::javascript);
router.get(prefix + "webauthn/logout").handler(controller::logout);

When the default callback is reachable, it restores the WebAuthn challenge and username from Quarkus-managed cookies, uses that username to authenticate the WebAuthn response, and saves a persistent login cookie:

RestoreResult challenge = authMech.getLoginManager().restore(ctx, CHALLENGE_COOKIE);
RestoreResult username = authMech.getLoginManager().restore(ctx, USERNAME_COOKIE);

WebAuthnCredentials credentials = new WebAuthnCredentials()
        .setChallenge(challenge.getPrincipal())
        .setUsername(username.getPrincipal())
        .setWebauthn(webauthnResp);

authMech.getLoginManager().save(identity, ctx, null, ctx.request().isSSL());

For applications that rely on custom finalization endpoints, this exposes an alternate authentication path. An attacker can target the default callback instead of the custom endpoint, bypassing application-specific user binding or account checks. The resulting session cookie can represent a user that the application did not create through its intended flow, or an existing user whose username is known to the attacker, depending on how the application's WebAuthn user provider is implemented.

This vulnerability was introduced in 2022 with Quarkus 2.9.

‍

Mitigation

Only recent versions of Quarkus are community-supported. The affected 2.16.x line is End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade Quarkus to a currently supported release that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.