CVE-2024-12225: Critical Security Vulnerability in Quarkus WebAuthn Module

Overview

This blog post provides a detailed examination of CVE-2024-12225, a recently identified critical security flaw in the Quarkus WebAuthn security module. This vulnerability, rated at a high severity score of 9.1 by Common Vulnerability Scoring System (CVSS), poses a potential risk to any application built using the Quarkus WebAuthn module. If exploited, it could lead to system compromise or data leakage, putting sensitive data at risk. Understanding this vulnerability and how to mitigate it is crucial for developers and cybersecurity professionals working with Quarkus.

Vulnerability Summary

CVE ID: CVE-2024-12225
Severity: Critical (9.1 CVSS score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage

Affected Products

Product | Affected Versions

Quarkus WebAuthn Module | All versions prior to patched version

How the Exploit Works

The vulnerability lies in the Quarkus WebAuthn module’s handling of default REST endpoints. When developers provide custom REST endpoints, the default endpoints remain accessible. This vulnerability can be exploited if an attacker sends a request to these default endpoints. The module then returns a login cookie that could correspond to an existing user that has no relation with the current attacker, allowing anyone to log in as an existing user by just knowing that user’s user name.

Conceptual Example Code

Here’s a conceptual example of how the vulnerability might be exploited. This is a simple HTTP request to the default endpoint, which could return a login cookie that might correspond to an existing user:

POST /default/endpoint HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "username": "known_username" }

In the example above, the attacker sends a POST request to the default endpoint with a known username. If the application is vulnerable, it will return a login cookie, which the attacker can then use to impersonate the user.

Mitigation Guidance

To mitigate the vulnerability, it is recommended to apply the vendor patch as soon as it is available. In the meantime, a web application firewall (WAF) or intrusion detection system (IDS) can be used as a temporary mitigation. This should not be considered a long-term solution. Updating to the patched version of the Quarkus WebAuthn module should be prioritized to ensure the security of the application.
Stay vigilant, stay informed, and stay safe in the ever-changing landscape of cybersecurity threats.