Listen to this Post
How the CVE Works
OpenFGA versions v1.9.3 to v1.9.4 suffer from improper policy enforcement due to flawed relationship checks in authorization models. When multiple usersets of the same type are assigned to a relationship, certain `Check` and `ListObject` API calls fail to enforce policies correctly. This occurs when queries rely on these relationships and userset tuples exist, leading to unauthorized access or privilege escalation. The issue stems from incorrect optimization logic in authorization validation.
DailyCVE Form
Platform: OpenFGA
Version: v1.9.3-v1.9.4
Vulnerability: Improper Policy Enforcement
Severity: Critical
Date: 2024-XX-XX
Prediction: Patch by 2024-XX-XX
What Undercode Say
Check OpenFGA version
helm list -n openfga
docker inspect openfga/openfga -f '{{.Config.Labels.version}}'
Verify experimental flags
echo $OPENFGA_EXPERIMENTALS
Remediation command
helm upgrade openfga --version 0.2.42
How Exploit
- Craft malicious
Check/ListObjectrequests - Abuse multi-userset relationships
- Bypass authorization checks
Protection from this CVE
- Upgrade to v1.9.5
- Disable `enable-check-optimizations`
– Audit relationship assignments
Impact
- Unauthorized data access
- Privilege escalation
- Policy bypass
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
