Listen to this Post
How the mentioned CVE works:
The vulnerability CVE-2024-46772 is a logic flaw in SpiceDB’s `LookupResources` API. When a schema defines a permission using a union (+) that references the same relation on both sides, but one side uses an arrow to a different permission, the computation for resource lookup becomes incorrect. Specifically, the recursive lookup process fails to traverse the arrowed permission path under these specific union conditions. This causes the `LookupResources` call to omit resources that the subject should have permission to access. While `CheckPermission` correctly evaluates permissionship for a specific resource, `LookupResources` returns an incomplete list. This creates a discrepancy where a user can verify access to a known resource but cannot discover all resources they are permitted to view, leading to a partial bypass of access control during discovery operations.
Platform: SpiceDB
Version: <1.47.1
Vulnerability: Logic Flaw
Severity: Critical
date: 2024
Prediction: 2024-11-15
What Undercode Say:
curl -X POST $SPICEDB_ENDPOINT \
-H "Authorization: Bearer $TOKEN" \
-d '{"permission":"view", "resource_object_type":"system", "subject": {"object": {"type":"user", "id":"someuser1"}}}'
definition user {
relation special_user_mapping: special_user
permission special_user = special_user_mapping
}
definition system {
relation viewer: user | groupmembership
permission view = viewer + viewer->special_user
}
How Exploit:
Craft union permissions.
Chain arrow relations.
Call LookupResources API.
Observe missing resources.
Protection from this CVE
Upgrade to v1.47.1.
Audit schema unions.
Review permission arrows.
Test LookupResources thoroughly.
Impact:
Incomplete resource discovery.
Access control bypass.
Information disclosure.
Broken authorization.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
