PT-2023-25391 · Openfga · Openfga

Jon-Whit · Published 2023-06-26 · Updated 2023-07-06 · CVE-2023-35933

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenFGA versions v1.1.0 and prior

Description The issue concerns a denial of service attack that can occur when certain Check or ListObjects calls are executed against authorization models containing circular relationship definitions. Users are affected if they are using OpenFGA v1.1.0 or earlier and are executing these calls against a vulnerable authorization model. There are no known workarounds for this issue. Users without circular relationships in their models are not affected.

Recommendations Upgrade to version 1.1.1. If you are not passing an invalid authorization model as a parameter of your Check and ListObjects calls, this upgrade is backwards compatible. Otherwise, OpenFGA v1.1.1 will start returning HTTP 400 status codes on those calls. As a temporary workaround, consider avoiding the execution of Check and ListObjects calls against authorization models that contain circular relationship definitions until the upgrade is applied.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2023-35933

GHSA-HR9R-8PHQ-5X8J

GO-2023-1872

Affected Products

Openfga

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35933.json · Exploit
• 🔥 https://openfga.dev/api/service#/Relationship%20Queries/Check · Exploit
• 🔥 https://openfga.dev/api/service#/Relationship%20Queries/ListObjects · Exploit
• https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j · Vendor Advisory
• https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452 · Patch
• https://osv.dev/vulnerability/CVE-2023-35933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35933 · Security Note
• https://osv.dev/vulnerability/GHSA-hr9r-8phq-5x8j · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1872 · Vendor Advisory
• https://github.com/openfga/openfga · Note
• https://t.me/cvenotify/53051 · Telegram Post