cvelistv5 - cve-2023-43645

CVE-2023-43645 (GCVE-0-2023-43645)

Vulnerability from cvelistv5 – Published: 2023-09-26 20:58 – Updated: 2024-09-23 20:20

Title

Denial of service from circular relationship definitions in OpenFGA

Summary

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it's possible for the server to exhaust resources and die. Users are advised to upgrade to v1.3.2 and update any offending models. There are no known workarounds for this vulnerability. Note that for models which contained cycles or a relation definition that has the relation itself in its evaluation path, checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. Users who do not have cyclic models are unaffected.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/openfga/openfga/security/advis…	x_refsource_CONFIRM
	https://github.com/openfga/openfga/commit/7252960…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	openfga	openfga	Affected: < 1.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:44:43.823Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh"
          },
          {
            "name": "https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-43645",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-23T20:20:03.702938Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-23T20:20:10.674Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openfga",
          "vendor": "openfga",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it\u0027s possible for the server to exhaust resources and die. Users are advised to upgrade to v1.3.2 and update any offending models. There are no known workarounds for this vulnerability. Note that for models which contained cycles or a relation definition that has the relation itself in its evaluation path, checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. Users who do not have cyclic models are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-26T20:58:17.826Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh"
        },
        {
          "name": "https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6"
        }
      ],
      "source": {
        "advisory": "GHSA-2hm9-h873-pgqh",
        "discovery": "UNKNOWN"
      },
      "title": "Denial of service from circular relationship definitions in OpenFGA"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-43645",
    "datePublished": "2023-09-26T20:58:17.826Z",
    "dateReserved": "2023-09-20T15:35:38.146Z",
    "dateUpdated": "2024-09-23T20:20:10.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.3.2\", \"matchCriteriaId\": \"96CAB7D1-0960-4345-AE65-6BCC577FAA24\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it\u0027s possible for the server to exhaust resources and die. Users are advised to upgrade to v1.3.2 and update any offending models. There are no known workarounds for this vulnerability. Note that for models which contained cycles or a relation definition that has the relation itself in its evaluation path, checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. Users who do not have cyclic models are unaffected.\"}, {\"lang\": \"es\", \"value\": \"OpenFGA es un motor de autorizaci\\u00f3n/permisos creado para desarrolladores e inspirado en Google Zanzibar. OpenFGA es vulnerable a un ataque de denegaci\\u00f3n de servicio cuando ciertas llamadas de verificaci\\u00f3n se ejecutan contra modelos de autorizaci\\u00f3n que contienen definiciones de relaciones circulares. Cuando se realiza la llamada, es posible que el servidor agote los recursos y muera. Se recomienda a los usuarios que actualicen a la versi\\u00f3n 1.3.2 y actualicen cualquier modelo infractor. No se conocen workarounds para esta vulnerabilidad. Tenga en cuenta que para los modelos que contienen ciclos o una definici\\u00f3n de relaci\\u00f3n que tiene la relaci\\u00f3n misma en su ruta de evaluaci\\u00f3n, las comprobaciones y consultas que requieren evaluaci\\u00f3n ya no se evaluar\\u00e1n en la versi\\u00f3n 1.3.2+ y, en su lugar, devolver\\u00e1n errores. Los usuarios que no tienen modelos c\\u00edclicos no se ven afectados.\"}]",
      "id": "CVE-2023-43645",
      "lastModified": "2024-11-21T08:24:32.093",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 3.6}]}",
      "published": "2023-09-27T15:19:34.330",
      "references": "[{\"url\": \"https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-835\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-43645\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-09-27T15:19:34.330\",\"lastModified\":\"2024-11-21T08:24:32.093\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it\u0027s possible for the server to exhaust resources and die. Users are advised to upgrade to v1.3.2 and update any offending models. There are no known workarounds for this vulnerability. Note that for models which contained cycles or a relation definition that has the relation itself in its evaluation path, checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. Users who do not have cyclic models are unaffected.\"},{\"lang\":\"es\",\"value\":\"OpenFGA es un motor de autorizaci\u00f3n/permisos creado para desarrolladores e inspirado en Google Zanzibar. OpenFGA es vulnerable a un ataque de denegaci\u00f3n de servicio cuando ciertas llamadas de verificaci\u00f3n se ejecutan contra modelos de autorizaci\u00f3n que contienen definiciones de relaciones circulares. Cuando se realiza la llamada, es posible que el servidor agote los recursos y muera. Se recomienda a los usuarios que actualicen a la versi\u00f3n 1.3.2 y actualicen cualquier modelo infractor. No se conocen workarounds para esta vulnerabilidad. Tenga en cuenta que para los modelos que contienen ciclos o una definici\u00f3n de relaci\u00f3n que tiene la relaci\u00f3n misma en su ruta de evaluaci\u00f3n, las comprobaciones y consultas que requieren evaluaci\u00f3n ya no se evaluar\u00e1n en la versi\u00f3n 1.3.2+ y, en su lugar, devolver\u00e1n errores. Los usuarios que no tienen modelos c\u00edclicos no se ven afectados.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.3.2\",\"matchCriteriaId\":\"96CAB7D1-0960-4345-AE65-6BCC577FAA24\"}]}]}],\"references\":[{\"url\":\"https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh\", \"name\": \"https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6\", \"name\": \"https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T19:44:43.823Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-43645\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-23T20:20:03.702938Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-23T20:20:07.297Z\"}}], \"cna\": {\"title\": \"Denial of service from circular relationship definitions in OpenFGA\", \"source\": {\"advisory\": \"GHSA-2hm9-h873-pgqh\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"openfga\", \"product\": \"openfga\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.3.2\"}]}], \"references\": [{\"url\": \"https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh\", \"name\": \"https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6\", \"name\": \"https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it\u0027s possible for the server to exhaust resources and die. Users are advised to upgrade to v1.3.2 and update any offending models. There are no known workarounds for this vulnerability. Note that for models which contained cycles or a relation definition that has the relation itself in its evaluation path, checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. Users who do not have cyclic models are unaffected.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-835\", \"description\": \"CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-09-26T20:58:17.826Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-43645\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-23T20:20:10.674Z\", \"dateReserved\": \"2023-09-20T15:35:38.146Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-09-26T20:58:17.826Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-2HM9-H873-PGQH

Vulnerability from github – Published: 2023-09-28 21:27 – Updated: 2023-09-28 21:27

Summary

OpenFGA Vulnerable to DoS from circular relationship definitions

Details

Overview

OpenFGA is vulnerable to a DoS attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it's possible for the server to exhaust resources and die.

Am I Affected?

Yes, if your store contains an authorization model that allows circular relationships. For example, with this model:

model
  schema 1.1

type user

type group
  relations
    define memberA: [user] or memberB or memberC or memberD or memberE
    define memberB: [user] or memberA or memberC or memberD or memberE
    define memberC: [user] or memberA or memberB or memberD or memberE
    define memberD: [user] or memberA or memberB or memberC or memberE
    define memberE: [user] or memberA or memberB or memberC or memberD

This Check: (user:anne, memberA, group:X) can exhaust memory in the server.

Fix

Upgrade to v1.3.2 and update any offending models.

[BREAKING] If your model contained cycles or a relation definition that has the relation itself in its evaluation path, then Checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. You will need to update your models to remove the cycles.

Severity ?

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openfga/openfga"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-43645"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-28T21:27:04Z",
    "nvd_published_at": "2023-09-27T15:19:34Z",
    "severity": "MODERATE"
  },
  "details": "## Overview\nOpenFGA is vulnerable to a DoS attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it\u0027s possible for the server to exhaust resources and die.\n\n## Am I Affected?\nYes, if your store contains an authorization model that allows circular relationships. For example, with this model:\n\n```\nmodel\n  schema 1.1\n\ntype user\n\ntype group\n  relations\n    define memberA: [user] or memberB or memberC or memberD or memberE\n    define memberB: [user] or memberA or memberC or memberD or memberE\n    define memberC: [user] or memberA or memberB or memberD or memberE\n    define memberD: [user] or memberA or memberB or memberC or memberE\n    define memberE: [user] or memberA or memberB or memberC or memberD\n```\n\nThis Check: `(user:anne, memberA, group:X)` can exhaust memory in the server.\n\n## Fix\nUpgrade to v1.3.2 and update any offending models.\n\n  **[BREAKING]** If your model contained cycles or a relation definition that has the relation itself in its evaluation path, then Checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. You will need to update your models to remove the cycles.",
  "id": "GHSA-2hm9-h873-pgqh",
  "modified": "2023-09-28T21:27:04Z",
  "published": "2023-09-28T21:27:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43645"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openfga/openfga"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenFGA Vulnerable to DoS from circular relationship definitions"
}

FKIE_CVE-2023-43645

Vulnerability from fkie_nvd - Published: 2023-09-27 15:19 - Updated: 2024-11-21 08:24

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6	Patch
security-advisories@github.com	https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh	Vendor Advisory

Impacted products

	Vendor	Product	Version
	openfga	openfga	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "96CAB7D1-0960-4345-AE65-6BCC577FAA24",
              "versionEndExcluding": "1.3.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it\u0027s possible for the server to exhaust resources and die. Users are advised to upgrade to v1.3.2 and update any offending models. There are no known workarounds for this vulnerability. Note that for models which contained cycles or a relation definition that has the relation itself in its evaluation path, checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. Users who do not have cyclic models are unaffected."
    },
    {
      "lang": "es",
      "value": "OpenFGA es un motor de autorizaci\u00f3n/permisos creado para desarrolladores e inspirado en Google Zanzibar. OpenFGA es vulnerable a un ataque de denegaci\u00f3n de servicio cuando ciertas llamadas de verificaci\u00f3n se ejecutan contra modelos de autorizaci\u00f3n que contienen definiciones de relaciones circulares. Cuando se realiza la llamada, es posible que el servidor agote los recursos y muera. Se recomienda a los usuarios que actualicen a la versi\u00f3n 1.3.2 y actualicen cualquier modelo infractor. No se conocen workarounds para esta vulnerabilidad. Tenga en cuenta que para los modelos que contienen ciclos o una definici\u00f3n de relaci\u00f3n que tiene la relaci\u00f3n misma en su ruta de evaluaci\u00f3n, las comprobaciones y consultas que requieren evaluaci\u00f3n ya no se evaluar\u00e1n en la versi\u00f3n 1.3.2+ y, en su lugar, devolver\u00e1n errores. Los usuarios que no tienen modelos c\u00edclicos no se ven afectados."
    }
  ],
  "id": "CVE-2023-43645",
  "lastModified": "2024-11-21T08:24:32.093",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-09-27T15:19:34.330",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GSD-2023-43645

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-43645

Aliases

CVE-2023-43645

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-43645",
    "id": "GSD-2023-43645"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-43645"
      ],
      "details": "OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it\u0027s possible for the server to exhaust resources and die. Users are advised to upgrade to v1.3.2 and update any offending models. There are no known workarounds for this vulnerability. Note that for models which contained cycles or a relation definition that has the relation itself in its evaluation path, checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. Users who do not have cyclic models are unaffected.",
      "id": "GSD-2023-43645",
      "modified": "2023-12-13T01:20:44.513541Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-43645",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "openfga",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 1.3.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "openfga"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it\u0027s possible for the server to exhaust resources and die. Users are advised to upgrade to v1.3.2 and update any offending models. There are no known workarounds for this vulnerability. Note that for models which contained cycles or a relation definition that has the relation itself in its evaluation path, checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. Users who do not have cyclic models are unaffected."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-835",
                "lang": "eng",
                "value": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh",
            "refsource": "MISC",
            "url": "https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh"
          },
          {
            "name": "https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6",
            "refsource": "MISC",
            "url": "https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-2hm9-h873-pgqh",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.3.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-43645"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it\u0027s possible for the server to exhaust resources and die. Users are advised to upgrade to v1.3.2 and update any offending models. There are no known workarounds for this vulnerability. Note that for models which contained cycles or a relation definition that has the relation itself in its evaluation path, checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. Users who do not have cyclic models are unaffected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-835"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://github.com/openfga/openfga/security/advisories/GHSA-2hm9-h873-pgqh"
            },
            {
              "name": "https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-10-02T16:41Z",
      "publishedDate": "2023-09-27T15:19Z"
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-43645 (GCVE-0-2023-43645)

GHSA-2HM9-H873-PGQH

Overview

Am I Affected?

Fix

FKIE_CVE-2023-43645

GSD-2023-43645

Tags

Sightings

Nomenclature