cvelistv5 - cve-2023-35933

CVE-2023-35933 (GCVE-0-2023-35933)

Vulnerability from cvelistv5 – Published: 2023-06-26 19:26 – Updated: 2024-12-03 18:41

Title

OpenFGA denial of service die to circular relationship

Summary

OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/openfga/openfga/security/advis…	x_refsource_CONFIRM
	https://github.com/openfga/openfga/commit/087ce39…	x_refsource_MISC
	https://openfga.dev/api/service#/Relationship%20Q…	x_refsource_MISC
	https://openfga.dev/api/service#/Relationship%20Q…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	openfga	openfga	Affected: < 1.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:37:40.084Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j"
          },
          {
            "name": "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452"
          },
          {
            "name": "https://openfga.dev/api/service#/Relationship%20Queries/Check",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://openfga.dev/api/service#/Relationship%20Queries/Check"
          },
          {
            "name": "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-35933",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-03T18:41:46.527601Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-03T18:41:56.738Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openfga",
          "vendor": "openfga",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-26T19:26:30.929Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j"
        },
        {
          "name": "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452"
        },
        {
          "name": "https://openfga.dev/api/service#/Relationship%20Queries/Check",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://openfga.dev/api/service#/Relationship%20Queries/Check"
        },
        {
          "name": "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects"
        }
      ],
      "source": {
        "advisory": "GHSA-hr9r-8phq-5x8j",
        "discovery": "UNKNOWN"
      },
      "title": "OpenFGA denial of service die to circular relationship"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-35933",
    "datePublished": "2023-06-26T19:26:30.929Z",
    "dateReserved": "2023-06-20T14:02:45.593Z",
    "dateUpdated": "2024-12-03T18:41:56.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.1.1\", \"matchCriteriaId\": \"9095E429-49EA-4877-9CE1-F014340AEA2F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.\"}, {\"lang\": \"es\", \"value\": \"OpenFGA es un motor de autorizaci\\u00f3n/permiso de c\\u00f3digo abierto creado para desarrolladores. Las versiones v1.1.0 y anteriores de OpenFGA son vulnerables a un ataque DoS cuando se ejecutan llamadas a \\\"Check\\\" y \\\"ListObjects\\\" contra modelos de autorizaci\\u00f3n que contienen definiciones de relaciones circulares. Los usuarios se ven afectados por esta vulnerabilidad si utilizan OpenFGA v1.1.0 o anterior, y si se ejecutan llamadas \\\"Check\\\" o \\\"ListObjects\\\" contra un modelo de autorizaci\\u00f3n vulnerable. Se recomienda a los usuarios que actualicen la versi\\u00f3n 1.1.1. No se conocen soluciones para esta vulnerabilidad. Los usuarios que no tengan relaciones circulares en sus modelos no se ver\\u00e1n afectados. \"}]",
      "id": "CVE-2023-35933",
      "lastModified": "2024-11-21T08:09:00.350",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2023-06-26T20:15:10.580",
      "references": "[{\"url\": \"https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://openfga.dev/api/service#/Relationship%20Queries/Check\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}, {\"url\": \"https://openfga.dev/api/service#/Relationship%20Queries/ListObjects\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}, {\"url\": \"https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://openfga.dev/api/service#/Relationship%20Queries/Check\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}, {\"url\": \"https://openfga.dev/api/service#/Relationship%20Queries/ListObjects\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-835\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-35933\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-06-26T20:15:10.580\",\"lastModified\":\"2024-11-21T08:09:00.350\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.\"},{\"lang\":\"es\",\"value\":\"OpenFGA es un motor de autorizaci\u00f3n/permiso de c\u00f3digo abierto creado para desarrolladores. Las versiones v1.1.0 y anteriores de OpenFGA son vulnerables a un ataque DoS cuando se ejecutan llamadas a \\\"Check\\\" y \\\"ListObjects\\\" contra modelos de autorizaci\u00f3n que contienen definiciones de relaciones circulares. Los usuarios se ven afectados por esta vulnerabilidad si utilizan OpenFGA v1.1.0 o anterior, y si se ejecutan llamadas \\\"Check\\\" o \\\"ListObjects\\\" contra un modelo de autorizaci\u00f3n vulnerable. Se recomienda a los usuarios que actualicen la versi\u00f3n 1.1.1. No se conocen soluciones para esta vulnerabilidad. Los usuarios que no tengan relaciones circulares en sus modelos no se ver\u00e1n afectados. \"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.1.1\",\"matchCriteriaId\":\"9095E429-49EA-4877-9CE1-F014340AEA2F\"}]}]}],\"references\":[{\"url\":\"https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://openfga.dev/api/service#/Relationship%20Queries/Check\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://openfga.dev/api/service#/Relationship%20Queries/ListObjects\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://openfga.dev/api/service#/Relationship%20Queries/Check\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://openfga.dev/api/service#/Relationship%20Queries/ListObjects\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j\", \"name\": \"https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452\", \"name\": \"https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://openfga.dev/api/service#/Relationship%20Queries/Check\", \"name\": \"https://openfga.dev/api/service#/Relationship%20Queries/Check\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://openfga.dev/api/service#/Relationship%20Queries/ListObjects\", \"name\": \"https://openfga.dev/api/service#/Relationship%20Queries/ListObjects\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T16:37:40.084Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-35933\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-03T18:41:46.527601Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-03T18:41:53.166Z\"}}], \"cna\": {\"title\": \"OpenFGA denial of service die to circular relationship\", \"source\": {\"advisory\": \"GHSA-hr9r-8phq-5x8j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"openfga\", \"product\": \"openfga\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.1.1\"}]}], \"references\": [{\"url\": \"https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j\", \"name\": \"https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452\", \"name\": \"https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://openfga.dev/api/service#/Relationship%20Queries/Check\", \"name\": \"https://openfga.dev/api/service#/Relationship%20Queries/Check\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://openfga.dev/api/service#/Relationship%20Queries/ListObjects\", \"name\": \"https://openfga.dev/api/service#/Relationship%20Queries/ListObjects\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-835\", \"description\": \"CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-06-26T19:26:30.929Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-35933\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-03T18:41:56.738Z\", \"dateReserved\": \"2023-06-20T14:02:45.593Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-06-26T19:26:30.929Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GSD-2023-35933

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-35933

Aliases

CVE-2023-35933

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-35933",
    "id": "GSD-2023-35933"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-35933"
      ],
      "details": "OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.",
      "id": "GSD-2023-35933",
      "modified": "2023-12-13T01:20:46.455444Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-35933",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "openfga",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 1.1.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "openfga"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-835",
                "lang": "eng",
                "value": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j",
            "refsource": "MISC",
            "url": "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j"
          },
          {
            "name": "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452",
            "refsource": "MISC",
            "url": "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452"
          },
          {
            "name": "https://openfga.dev/api/service#/Relationship%20Queries/Check",
            "refsource": "MISC",
            "url": "https://openfga.dev/api/service#/Relationship%20Queries/Check"
          },
          {
            "name": "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects",
            "refsource": "MISC",
            "url": "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-hr9r-8phq-5x8j",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003cv1.1.1",
          "affected_versions": "All versions before 1.1.1",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-78",
            "CWE-835",
            "CWE-937"
          ],
          "date": "2023-07-03",
          "description": "OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior is vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.",
          "fixed_versions": [
            "v1.1.1"
          ],
          "identifier": "CVE-2023-35933",
          "identifiers": [
            "GHSA-hr9r-8phq-5x8j",
            "CVE-2023-35933"
          ],
          "not_impacted": "All versions starting from 1.1.1",
          "package_slug": "go/github.com/openfga/openfga",
          "pubdate": "2023-06-28",
          "solution": "Upgrade to version 1.1.1 or above.",
          "title": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
          "urls": [
            "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j",
            "https://nvd.nist.gov/vuln/detail/CVE-2023-35933",
            "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452",
            "https://openfga.dev/api/service#/Relationship%20Queries/Check",
            "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects",
            "https://github.com/advisories/GHSA-hr9r-8phq-5x8j"
          ],
          "uuid": "8415ffd4-bba2-40d2-bd24-9fa2953b80ff",
          "versions": [
            {
              "commit": {
                "sha": "a989901713e12401af7d2b02c36235eebf24f933",
                "tags": [
                  "v1.1.1"
                ],
                "timestamp": "20230626213906"
              },
              "number": "v1.1.1"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.1.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-35933"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-835"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://openfga.dev/api/service#/Relationship%20Queries/Check",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Vendor Advisory"
              ],
              "url": "https://openfga.dev/api/service#/Relationship%20Queries/Check"
            },
            {
              "name": "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452"
            },
            {
              "name": "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Vendor Advisory"
              ],
              "url": "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects"
            },
            {
              "name": "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-07-06T18:13Z",
      "publishedDate": "2023-06-26T20:15Z"
    }
  }
}

GHSA-HR9R-8PHQ-5X8J

Vulnerability from github – Published: 2023-06-28 22:49 – Updated: 2023-07-03 18:39

Summary

OpenFGA vulnerable to denial of service due to circular relationship

Details

Overview

OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when certain Check and ListObjects calls are executed against authorization models that contain circular relationship definitions.

Am I Affected?

You are affected by this vulnerability if you are using OpenFGA v1.1.0 or earlier, and if you are executing certain Check or ListObjects calls against a vulnerable authorization model. To see which of your models could be vulnerable to this attack, download OpenFGA v1.2.0 and run the following command:

./openfga validate-models --datastore-engine <ENGINE> --datastore-uri <URI> | jq .[] | select(.Error | contains("loop"))

replacing the variables <ENGINE> and <URI> as needed.

Fix

Upgrade to v1.1.1.

Backward Compatibility

If you are not passing an invalid authorization model (as identified by running ./openfga validate-models) as a parameter of your Check and ListObjects calls, this upgrade is backwards compatible.

Otherwise, OpenFGA v1.1.1 will start returning HTTP 400 status codes on those calls.

Severity ?

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openfga/openfga"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-35933"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-28T22:49:49Z",
    "nvd_published_at": "2023-06-26T20:15:10Z",
    "severity": "MODERATE"
  },
  "details": "### Overview\n\nOpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when certain Check and ListObjects calls are executed against authorization models that contain circular relationship definitions.\n\n### Am I Affected?\n\nYou are affected by this vulnerability if you are using OpenFGA v1.1.0 or earlier, and if you are executing certain [Check](https://openfga.dev/api/service#/Relationship%20Queries/Check) or [ListObjects](https://openfga.dev/api/service#/Relationship%20Queries/ListObjects) calls against a vulnerable authorization model. To see which of your models could be vulnerable to this attack, download OpenFGA v1.2.0 and run the following command: \n\n```\n./openfga validate-models --datastore-engine \u003cENGINE\u003e --datastore-uri \u003cURI\u003e | jq .[] | select(.Error | contains(\"loop\"))\n```\n\nreplacing the variables `\u003cENGINE\u003e` and `\u003cURI\u003e` as needed.\n\n### Fix\n\nUpgrade to v1.1.1.\n\n### Backward Compatibility\n\nIf you are not passing an invalid authorization model (as identified by running `./openfga validate-models`) as a parameter of your Check and ListObjects calls, this upgrade is backwards compatible. \n\nOtherwise, OpenFGA v1.1.1 will start returning HTTP 400 status codes on those calls.",
  "id": "GHSA-hr9r-8phq-5x8j",
  "modified": "2023-07-03T18:39:26Z",
  "published": "2023-06-28T22:49:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35933"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openfga/openfga"
    },
    {
      "type": "WEB",
      "url": "https://openfga.dev/api/service#/Relationship%20Queries/Check"
    },
    {
      "type": "WEB",
      "url": "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenFGA vulnerable to denial of service due to circular relationship"
}

FKIE_CVE-2023-35933

Vulnerability from fkie_nvd - Published: 2023-06-26 20:15 - Updated: 2024-11-21 08:09

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452	Patch
security-advisories@github.com	https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j	Vendor Advisory
security-advisories@github.com	https://openfga.dev/api/service#/Relationship%20Queries/Check	Exploit, Vendor Advisory
security-advisories@github.com	https://openfga.dev/api/service#/Relationship%20Queries/ListObjects	Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://openfga.dev/api/service#/Relationship%20Queries/Check	Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://openfga.dev/api/service#/Relationship%20Queries/ListObjects	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	openfga	openfga	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9095E429-49EA-4877-9CE1-F014340AEA2F",
              "versionEndExcluding": "1.1.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected."
    },
    {
      "lang": "es",
      "value": "OpenFGA es un motor de autorizaci\u00f3n/permiso de c\u00f3digo abierto creado para desarrolladores. Las versiones v1.1.0 y anteriores de OpenFGA son vulnerables a un ataque DoS cuando se ejecutan llamadas a \"Check\" y \"ListObjects\" contra modelos de autorizaci\u00f3n que contienen definiciones de relaciones circulares. Los usuarios se ven afectados por esta vulnerabilidad si utilizan OpenFGA v1.1.0 o anterior, y si se ejecutan llamadas \"Check\" o \"ListObjects\" contra un modelo de autorizaci\u00f3n vulnerable. Se recomienda a los usuarios que actualicen la versi\u00f3n 1.1.1. No se conocen soluciones para esta vulnerabilidad. Los usuarios que no tengan relaciones circulares en sus modelos no se ver\u00e1n afectados. "
    }
  ],
  "id": "CVE-2023-35933",
  "lastModified": "2024-11-21T08:09:00.350",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-06-26T20:15:10.580",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://openfga.dev/api/service#/Relationship%20Queries/Check"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://openfga.dev/api/service#/Relationship%20Queries/Check"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://openfga.dev/api/service#/Relationship%20Queries/ListObjects"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-35933 (GCVE-0-2023-35933)

GSD-2023-35933

GHSA-HR9R-8PHQ-5X8J

Overview

Am I Affected?

Fix

Backward Compatibility

FKIE_CVE-2023-35933

Tags

Sightings

Nomenclature