Fix Business Logic Errors in Quarkus
Business logic vulnerabilities in Quarkus often stem from a blind trust in the 'authenticated' state without verifying 'authorization' at the record level. Scanners won't find these. You're looking at Broken Object Level Authorization (BOLA) and state machine bypasses. If your Panache entity operations don't check ownership against the SecurityContext principal, you're leaking data.
The Vulnerable Pattern
@POST
@Path("/account/withdraw/{id}")
@RolesAllowed("USER")
@Transactional
public Response withdrawFunds(@PathParam("id") Long accountId, BigDecimal amount) {
// VULNERABILITY: Only checks if user is logged in, not if they own the account.
// An attacker can pass any accountId and drain it.
Account account = Account.findById(accountId);
account.balance = account.balance.subtract(amount);
return Response.ok(account).build();
}The Secure Implementation
The fix enforces strict data isolation by incorporating the authenticated Principal's identity directly into the database query. Instead of fetching an object and then checking permissions, we use the 'owner' field as a filter criteria in the Panache query. This prevents IDOR (Insecure Direct Object Reference). Additionally, we implement server-side validation for the transaction state (balance check) and use @Positive to prevent negative value injection attacks that could lead to unintended balance increases.
@Inject SecurityContext securityContext;@POST @Path(“/account/withdraw/{id}”) @RolesAllowed(“USER”) @Transactional public Response withdrawFunds(@PathParam(“id”) Long accountId, @Valid @Positive BigDecimal amount) { String principalName = securityContext.getUserPrincipal().getName(); // FIX: Query by both ID and Owner to ensure isolation. Account account = Account.find(“id = ?1 and owner = ?2”, accountId, principalName).firstResult();
if (account == null) { throw new NotFoundException("Account not found or access denied"); } if (account.balance.compareTo(amount) < 0) { throw new BadRequestException("Insufficient funds - logic check enforced"); } account.balance = account.balance.subtract(amount); return Response.ok(account).build();
}
Your Quarkus API
might be exposed to Business Logic Errors
74% of Quarkus apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.