Listen to this Post
CVE-2024-32471 is an authorization bypass vulnerability stemming from an incorrect policy enforcement mechanism in the OpenFGA engine. The flaw occurs when evaluating authorization models containing relations with conditional and non-conditional public access type bindings. Specifically, the engine’s evaluation logic for `Check` and `ListObjects` API calls fails when a relation is defined with a “type bound public access” that includes a condition, while the same relation is also defined in another context without such a condition. This inconsistency in handling the two types of bindings causes the engine to incorrectly resolve user permissions, potentially granting access to objects that should be restricted. The vulnerability allows an attacker to bypass intended authorization policies by exploiting this logical flaw in the relationship resolution process, leading to unauthorized data access.
Platform: OpenFGA
Version: 1.4.0-1.11.0
Vulnerability: Authorization Bypass
Severity: Critical
date: 2024
Prediction: 2024-04-24
What Undercode Say:
`curl -X POST $OPENFGA_SERVER_URL/check -d ‘{“tuple_key”:{“user”:”user:anne”,”relation”:”reader”,”object”:”document:budget”}}’`
`fga query check –user user:anne –relation reader –object document:budget`
`fga model write –file model.fga`
type user
type document
relations
define reader: [bash]
define writer: [bash] with condition
define can_read: reader or writer
conditions
is_owner: {
param: user: user,
context: {
"owner": {}
}
}
How Exploit:
Malicious Check Requests
Exploiting Model Inconsistency
Bypassing Conditional Policies
Protection from this CVE
Upgrade to v1.11.1
Audit Authorization Models
Review Type Bindings
Impact:
Unauthorized Data Access
Policy Enforcement Failure
Information Disclosure
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
