GHSA-hr9r-8phq-5x8j CVE-2023-35933 GO-2023-1872
OpenFGA vulnerable to denial of service due to circular relationship
- Severity
- 5.9 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.13%
- Chance of exploitation in the next 30 days. Higher than 66.46% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
1.1.1- Upgrade github.com/openfga/openfga to this version or later
Description
Overview
OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when certain Check and ListObjects calls are executed against authorization models that contain circular relationship definitions.
Am I Affected?
You are affected by this vulnerability if you are using OpenFGA v1.1.0 or earlier, and if you are executing certain Check or ListObjects calls against a vulnerable authorization model. To see which of your models could be vulnerable to this attack, download OpenFGA v1.2.0 and run the following command:
./openfga validate-models --datastore-engine <ENGINE> --datastore-uri <URI> | jq .[] | select(.Error | contains("loop"))
replacing the variables <ENGINE> and <URI> as needed.
Fix
Upgrade to v1.1.1.
Backward Compatibility
If you are not passing an invalid authorization model (as identified by running ./openfga validate-models) as a parameter of your Check and ListObjects calls, this upgrade is backwards compatible.
Otherwise, OpenFGA v1.1.1 will start returning HTTP 400 status codes on those calls.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/openfga/openfga | < 1.1.1 |
1.1.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/openfga/openfga Go → 1.1.1
- go
go get github.com/openfga/openfga@v1.1.1 && go mod tidy
Severity breakdown
CVSS 3.1 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-g3pg-frfm-pr2m OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user | Medium | Also affects github.com/openfga/openfga |
| GHSA-hcxc-wf8j-23hv OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset | High | Also affects github.com/openfga/openfga |
| GHSA-cf98-j28v-49v6 OpenFGA Improper Policy Enforcement | Medium | Also affects github.com/openfga/openfga |
| GHSA-8396-jffm-qx4w OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning | Medium | Also affects github.com/openfga/openfga |
| GHSA-57j5-qwp2-vqp6 OpenFGA has Improper Policy Enforcement | Medium | Also affects github.com/openfga/openfga |
| GHSA-68m9-983m-f3v5 OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response | Medium | Also affects github.com/openfga/openfga |
| GHSA-jwvj-g8pc-cx45 OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision | High | Also affects github.com/openfga/openfga |
| GHSA-h6c8-cww8-35hf OpenFGA has an Authorization Bypass through cached keys | Critical | Also affects github.com/openfga/openfga |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor