PT-2023-27517 · Openfga · Openfga

Aaguiarz · Published 2023-08-25 · Updated 2024-08-21 · CVE-2023-40579

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenFGA versions 1.3.0 and earlier

Description The issue affects OpenFGA, an authorization/permission engine, where some end users of versions 1.3.0 or earlier are vulnerable to authorization bypass when calling the "ListObjects" API endpoint. This means the API sometimes returns more objects than it should. The vulnerability affects customers using ListObjects with specific models, particularly those containing expressions of type rel1 from type1.

Recommendations Update to version 1.3.1, as this update is backward compatible and patches the issue. As a temporary workaround, consider restricting the use of the ListObjects API endpoint with models containing expressions of type rel1 from type1 until the update is applied.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-40579

GHSA-JCF2-MXR2-GMQP

GO-2023-2028

Affected Products

Openfga

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40579.json · Exploit
• https://github.com/openfga/openfga/security/advisories/GHSA-jcf2-mxr2-gmqp · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2028 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jcf2-mxr2-gmqp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40579 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40579 · Vendor Advisory
• https://github.com/openfga/openfga · Note
• https://github.com/openfga/openfga/releases/tag/v1.3.1 · Note
• https://t.me/cibsecurity/69210 · Telegram Post