CVE-2024-56323
📋 TL;DR
OpenFGA versions 1.3.8 to 1.8.2 contain an authorization bypass vulnerability when using conditions with contextual tuples and caching enabled. Attackers can bypass authorization checks to access unauthorized resources. This affects all OpenFGA deployments with the vulnerable configuration.
💻 Affected Systems
- OpenFGA
- OpenFGA Helm Chart
- OpenFGA Docker
📦 What is this software?
Helm Charts by Openfga
Openfga by Openfga
⚠️ Risk & Real-World Impact
Worst Case
Complete authorization bypass allowing unauthorized access to all protected resources and data
Likely Case
Selective authorization bypass enabling access to specific protected resources based on attacker-controlled contextual tuples
If Mitigated
Limited impact if proper network segmentation and additional authorization layers exist
🎯 Exploit Status
Exploitation requires specific API calls with contextual tuples and understanding of the target's authorization model
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.8.3
Vendor Advisory: https://github.com/openfga/openfga/security/advisories/GHSA-32q6-rr98-cjqv
Restart Required: Yes
Instructions:
1. Upgrade OpenFGA to version 1.8.3 or later. 2. Update Helm chart to openfga-0.2.20 or later. 3. Update Docker image to openfga/openfga:v1.8.3 or later. 4. Restart all OpenFGA instances.
🔧 Temporary Workarounds
Disable caching
allDisable the check query cache to prevent the vulnerability
export OPENFGA_CHECK_QUERY_CACHE_ENABLED=false
🧯 If You Can't Patch
- Disable caching by setting OPENFGA_CHECK_QUERY_CACHE_ENABLED=false
- Implement additional authorization layers outside OpenFGA for critical resources
🔍 How to Verify
Check if Vulnerable:
Check if OpenFGA version is between 1.3.8 and 1.8.2, and caching is enabled with conditions in useCheck Version:
curl -X GET http://openfga-host:8080/version | grep versionVerify Fix Applied:
Verify OpenFGA version is 1.8.3 or later and restart services📡 Detection & Monitoring
Log Indicators:
- Unusual Check API or ListObjects API calls with contextual tuples
- Authorization failures followed by unexpected successes
Network Indicators:
- Increased API calls to Check or ListObjects endpoints with contextual tuples
SIEM Query:
source="openfga" AND (api="Check" OR api="ListObjects") AND contextual_tuples EXISTS