Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.

CVE-2023-6267

Summary

A vulnerability exists within the JSON payload processing in Red Hat's REST resources. This flaw arises when annotation-based security is employed. During the processing of the JSON body prior to the evaluation and application of security constraints, the system becomes susceptible to attacks. This issue does not occur with configuration-based security, which ensures that security measures are implemented before the JSON data is deserialized. Such a discrepancy poses a significant risk to the integrity of data handled by affected products.

References