Unauthenticated Access Bypass in Quarkus REST Data Panache

Executive Summary

This vulnerability is in Quarkus REST Data Panache. It allows unauthenticated attackers to bypass security controls on generated endpoints. When developers customize operations using @MethodProperties without re-declaring security roles, class-level security requirements are silently dropped. This makes the endpoint permissive and accessible without authentication, risking unauthorized data access or modification.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Quarkus REST Data Panache endpoints for endpoints that should require authentication but do not enforce it. Check for endpoints using @MethodProperties where class-level security roles were not explicitly re-declared. Review application logs for unauthorized access attempts to sensitive endpoints. Use network scanners to identify exposed REST endpoints on Quarkus applications.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could exploit this to access sensitive endpoints, leading to unauthorized information disclosure or data modification. Systems using Quarkus REST Data Panache with customized endpoints may be exposed if security roles are not explicitly re-declared.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by allowing unauthorized access to sensitive data. Unauthenticated endpoints may lead to data breaches, resulting in legal penalties or loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Review endpoints using @MethodProperties in Quarkus REST Data Panache. Ensure class-level security roles are explicitly re-declared for all operations. Remove any endpoints with unauthenticated access that should require authentication.

Useful 0 Not Useful 0