PT-2022-16063 · Openfga · Openfga

Samyghannad · Published 2022-12-20 · Updated 2024-08-21 · CVE-2022-23542

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenFGA version 0.3.0

Description OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA is vulnerable to authorization bypass under certain conditions. The issue occurs when a model using modeling language v1.1 applies a type restriction to an object, and then the model is updated by adding a new type and replacing the previous restriction. This can lead to unauthorized access.

Recommendations For OpenFGA version 0.3.0, upgrade to version 0.3.1 to fix the authorization bypass issue. This update is backward compatible.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2022-23542

GHSA-M3Q4-7QMJ-657M

GO-2022-1179

Affected Products

Openfga

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23542.json · Exploit
• https://github.com/openfga/openfga/pull/422 · Patch
• https://osv.dev/vulnerability/GO-2022-1179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23542 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23542 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m3q4-7qmj-657m · Vendor Advisory
• https://github.com/openfga/openfga · Note
• https://github.com/openfga/openfga/security/advisories/GHSA-m3q4-7qmj-657m · Note
• https://github.com/openfga/openfga/releases/tag/v0.3.1 · Note
• https://t.me/cvenotify/40277 · Telegram Post
• https://t.me/cvenotify/41193 · Telegram Post
• https://t.me/cibsecurity/55030 · Telegram Post