CVE-2024-2700

Overview

Quarkus is a Kubernetes-native Java framework optimized for cloud-native applications, containers, and serverless workloads. It is designed around fast startup, low memory use, build-time processing, and developer-friendly integrations across REST, HTTP, security, data, messaging, and observability extensions.

An Information Exposure vulnerability (CVE-2024-2700) has been identified in Quarkus core runtime configuration recording, which allows attackers with local build-environment access to persist Quarkus namespace configuration values from the build environment into the deployed application's runtime defaults.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Quarkus in the io.quarkus:quarkus-core package.

‍

Details

Module Info

• Product: Quarkus
• Affected packages: io.quarkus:quarkus-core
• Affected versions: <3.2.12.Final, >=3.3.0.CR1 <=3.8.3, >=3.9.0.CR1 <=3.9.1
• GitHub repository: https://github.com/quarkusio/quarkus
• Published packages: https://central.sonatype.com/artifact/io.quarkus/quarkus-core
• Package manager: Maven
• Fixed in:
  
  • NES for Quarkus 2.16.x
  • OSS Quarkus 3.2.12.Final, 3.8.4 and 3.9.2

Vulnerability Info

This High-severity vulnerability is found in the io.quarkus:quarkus-core package in multiple versions of Quarkus. When Quarkus builds an application, BuildTimeConfigurationReader records runtime defaults for configuration roots and mappings so generated runtime configuration can start with build-time default values. In affected versions, the helper used for runtime defaults filters EnvConfigSource but keeps other local sources, including system properties and build-system properties. The runtime @ConfigMapping path also reads mapped values from the raw build config instead of from the filtered runtime-default config.

private SmallRyeConfig getConfigForRuntimeDefaults() {
    SmallRyeConfigBuilder builder = ConfigUtils.emptyConfigBuilder();
    for (ConfigSource configSource : config.getConfigSources()) {
        if (configSource instanceof EnvConfigSource) {
            continue;
        }
        builder.withSources(configSource);
    }
    return builder.build();
}

‍

for (ConfigClassWithPrefix mapping : runTimeMappings) {
    Set<String> mappedProperties = ConfigMappings.mappedProperties(mapping, allProperties);
    for (String property : mappedProperties) {
        unknownBuildProperties.remove(property);
        ConfigValue value = config.getConfigValue(property);
        if (value != null && value.getRawValue() != null) {
            runTimeDefaultValues.put(property, value.getRawValue());
        }
    }
}

A quarkus.* property supplied through a local build source can therefore be serialized into the built application's runtime defaults. If the deployment environment does not override the recorded value, the application can run with developer or CI settings that were meant only for build-time testing, such as permissive TLS behavior or destructive database startup behavior. Application-specific properties outside the Quarkus namespace are not captured by this issue.

‍

Mitigation

Only recent versions of Quarkus are community-supported. The affected 2.16.x line is End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade Quarkus to a currently supported release that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.