ghsa-7p8f-8hjm-wm92
Vulnerability from github
Published
2022-01-13 15:05
Modified
2022-01-13 15:02
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Summary
Lookup operations do not take into account wildcards in SpiceDB
Details

Impact

Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion.

For example, given schema:

```zed definition user {}

definition resource { relation viewer: user relation banned: user | user:* permission view = viewer - banned } ```

If user:* is placed into the banned relation for a particular resource, view should return false for all resources. in v1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in the banned wildcard being ignored in the exclusion.

Workarounds

Don't make use of wildcards on the right side of intersections or within exclusions.

References

https://github.com/authzed/spicedb/issues/358

For more information

If you have any questions or comments about this advisory: * Open an issue in SpiceDB * Ask a question in the SpiceDB Discord

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/authzed/spicedb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.0"
            },
            {
              "fixed": "1.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-21646"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-155",
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-11T21:06:45Z",
    "nvd_published_at": "2022-01-11T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nAny user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as \"accessible\" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion.\n\nFor example, given schema:\n\n```zed\ndefinition user {}\n\ndefinition resource {\n   relation viewer: user\n   relation banned: user | user:*\n   permission view = viewer - banned\n}\n```\n\nIf `user:*` is placed into the `banned` relation for a particular resource, `view` should return false for *all* resources. in `v1.3.0`, the wildcard is ignored entirely in lookup\u0027s dispatch, resulting in the `banned` wildcard being ignored in the exclusion.\n\n### Workarounds\nDon\u0027t make use of wildcards on the right side of intersections or within exclusions. \n\n### References\nhttps://github.com/authzed/spicedb/issues/358\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [SpiceDB](https://github.com/authzed/spicedb)\n* Ask a question in the [SpiceDB Discord](https://authzed.com/discord)\n",
  "id": "GHSA-7p8f-8hjm-wm92",
  "modified": "2022-01-13T15:02:31Z",
  "published": "2022-01-13T15:05:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-7p8f-8hjm-wm92"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21646"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authzed/spicedb/issues/358"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authzed/spicedb/commit/15bba2e2d2a4bda336a37a7fe8ef8a35028cd970"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/authzed/spicedb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authzed/spicedb/releases/tag/v1.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Lookup operations do not take into account wildcards in SpiceDB"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.