Описание
OpenFGA Authorization Bypass
Overview
During our internal security assessment, it was discovered that OpenFGA versions v0.2.4 and prior are vulnerable to authorization bypass under certain conditions.
Am I Affected?
You are affected by this vulnerability if you are using openfga/openfga version v0.2.4 or prior, and have tuples where the user field is set to a userset e.g. folder:test#owner, and the tuple's relation is used on the right-hand side of a from statement.
How to fix that?
Upgrade to version 0.2.5.
Backward Compatibility
This update is not backward compatible.
Any tuples where the user field is set to a userset, and the tuple's relation is used on the right-hand side of a from statement have to be rewritten.
Пакеты
github.com/openfga/openfga
<= 0.2.4
0.2.5
Связанные уязвимости
OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a ‘from’ statement). This issue has been patched in version v0.2.5. This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation.