PT-2022-16142 · Open Policy Agent · Open Policy Agent

Johanneslarsson · Published 2022-02-09 · Updated 2022-07-27 · CVE-2022-23628

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Open Policy Agent (OPA) versions prior to 0.37.2

Description Pretty-printing an abstract syntax tree (AST) that contains synthetic nodes can change the logic of some statements by reordering array literals. This issue affects policies that parse and compare web paths. Three conditions must be met to create an adverse effect:

1. An AST of Rego had to be created programmatically such that it ends up containing terms without a location (such as wildcard variables).
2. The AST had to be pretty-printed using the github.com/open-policy-agent/opa/format package.
3. The result of the pretty-printing had to be parsed and evaluated again via an OPA instance using the bundles, or the Golang packages. Notably, all three conditions would be true if using optimized bundles, i.e., bundles created with opa build -O=1 or higher.

Recommendations To resolve the issue, update to version 0.37.2 or later. As a temporary workaround, consider disabling optimization when creating bundles by not using the -O=1 flag or higher with the opa build command.

Exploit

Fix

Weakness Enumeration

CWE-682

Related Identifiers

CVE-2022-23628

GHSA-HCW3-J74M-QC58

GO-2022-0316

Affected Products

Open Policy Agent

References · 13

• 🔥 https://github.com/open-policy-agent/opa/security/advisories/GHSA-hcw3-j74m-qc58 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23628.json · Exploit
• https://github.com/open-policy-agent/opa/commit/bfd984ddf93ef2c4963a08d4fdadae0bcf1a3717 · Patch
• https://github.com/open-policy-agent/opa/pull/3851 · Patch
• https://github.com/open-policy-agent/opa/commit/932e4ffc37a590ace79e9b75ca4340288c220239 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23628 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23628 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0316 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcw3-j74m-qc58 · Vendor Advisory
• https://github.com/open-policy-agent/opa · Note
• https://github.com/open-policy-agent/opa/commit/2bd8edab9e10e2dc9cf76ae8335ced0c224f3055 · Note
• https://pkg.go.dev/vuln/GO-2022-0316 · Note
• https://t.me/cibsecurity/37123 · Telegram Post