PT-2023-28896 · Openfga · Openfga
Jon-Whit
·
Published
2023-09-26
·
Updated
2024-08-21
·
CVE-2023-43645
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
OpenFGA versions prior to 1.3.2
Description
OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. This can cause the server to exhaust resources and die. Users with models that contain cycles or a relation definition that has the relation itself in its evaluation path will need to update their models, as checks and queries that require evaluation will no longer be evaluated on version 1.3.2 and later, and will return errors instead.
Recommendations
For OpenFGA versions prior to 1.3.2, upgrade to version 1.3.2 and update any offending models to remove circular relationships.
As a temporary workaround, consider avoiding the use of Check calls against authorization models that contain circular relationship definitions until the issue is resolved.
Restrict access to models that contain cycles or a relation definition that has the relation itself in its evaluation path to minimize the risk of exploitation.
Exploit
Fix
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openfga