PT-2023-27517 · Openfga · Openfga

Aaguiarz · Publicado 2023-08-25 · Atualizado 2024-08-21 · CVE-2023-40579

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenFGA versions 1.3.0 and earlier

Description The issue affects OpenFGA, an authorization/permission engine, where some end users of versions 1.3.0 or earlier are vulnerable to authorization bypass when calling the "ListObjects" API endpoint. This means the API sometimes returns more objects than it should. The vulnerability affects customers using ListObjects with specific models, particularly those containing expressions of type rel1 from type1.

Recommendations Update to version 1.3.1, as this update is backward compatible and patches the issue. As a temporary workaround, consider restricting the use of the ListObjects API endpoint with models containing expressions of type rel1 from type1 until the update is applied.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2023-40579

GHSA-JCF2-MXR2-GMQP

GO-2023-2028

Produtos afetados

Openfga

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40579.json · Exploit
• https://github.com/openfga/openfga · Nota
• https://github.com/openfga/openfga/security/advisories/GHSA-jcf2-mxr2-gmqp · Aviso do Fabricante
• https://github.com/openfga/openfga/releases/tag/v1.3.1 · Nota
• https://osv.dev/vulnerability/CVE-2023-40579 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jcf2-mxr2-gmqp · Aviso do Fabricante
• https://t.me/cibsecurity/69210 · Publicação no Telegram
• https://osv.dev/vulnerability/GO-2023-2028 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-40579 · Nota de Segurança