CVE-2022-21646: Open Source Vulnerability in github.com/authzed/spicedb
Summary
CVE-2022-21646: Lookup operations do not take into account wildcards in SpiceDB. Affects github.com/authzed/spicedb versions >= 1.3.0, < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/authzed/spicedb is an open-source Go package that provides a database for managing and enforcing permissions in applications. It allows users to define relationships and permissions between different entities. This vulnerability affects versions 1.3.0 to 1.4.0 of the package.
Vulnerability Detail
The vulnerability in github.com/authzed/spicedb arises from a flaw in the lookup operations. When using a wildcard relationship under the right-hand branch of an exclusion or within an intersection operation, the lookup functions do not correctly account for the wildcard. As a result, resources that should be inaccessible due to the presence of the wildcard are incorrectly marked as accessible. This can lead to unauthorized access to resources. For example, if a user is placed in the 'banned' relation with the wildcard 'user:*' for a particular resource, the 'view' permission should return false for all resources. However, due to the vulnerability, the wildcard is ignored, and the 'view' permission may incorrectly return true for some resources.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
go get github.com/authzed/spicedb@v1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid using wildcards on the right side of intersections or within exclusions. By explicitly specifying the desired relationships instead of relying on wildcards, the vulnerability can be mitigated.
Conclusion
In conclusion, the vulnerability in github.com/authzed/spicedb allows unauthorized access to resources due to the incorrect handling of wildcards in lookup operations. Users should upgrade to version 1.4.0 or later to fix the vulnerability. Alternatively, the vulnerability can be mitigated by avoiding the use of wildcards in certain operations. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/authzed/spicedb →
FAQ
The vulnerability allows unauthorized access to resources. Resources that should be inaccessible may be incorrectly marked as accessible due to the incorrect handling of wildcards in lookup operations.
Versions 1.3.0 to 1.4.0 of github.com/authzed/spicedb are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this advisory.
Yes, the vulnerability has been fixed in version 1.4.0 of github.com/authzed/spicedb. Users should upgrade to this version or later to address the issue.
Yes, users can mitigate the vulnerability by avoiding the use of wildcards on the right side of intersections or within exclusions.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/authzed/spicedb.
