CVE-2024-31452

Executive Summary

CVE-2024-31452 is a high-severity authorization bypass vulnerability in OpenFGA, a high-performance authorization/permission engine. The flaw affects versions 1.5.0 through 1.5.2 and allows authenticated users to bypass authorization checks when the permission model uses exclusion (e.g., a but not b) or intersection (e.g., a and b) operators. This can lead to unauthorized access to resources or operations that should be denied. The vulnerability is fixed in version 1.5.3. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the potential impact is significant for organizations using complex permission models.

Supply Chain & Package Security

OpenFGA is a Go-based project. Organizations using OpenFGA as a dependency in their Go applications should update to v1.5.3 or later. The vulnerability is in the core authorization logic, not in a third-party package, but the fix is critical for maintaining the integrity of permission-based access control.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

The vulnerability is exploitable by an authenticated user with low privileges. No user interaction is required. The attack complexity is low, meaning the exploit can be easily reproduced. The impact on confidentiality and integrity is high, as an attacker can gain unauthorized access to resources or modify permissions.

Deep Dive & Mechanics

OpenFGA uses a relationship-based access control (ReBAC) model. The vulnerability lies in the evaluation of complex permission models involving exclusion (but not) and intersection (and) operators. When a user calls the Check or ListObjects APIs, the engine incorrectly resolves these operators, potentially granting access when it should be denied.

For example, consider a model where a user has access to "document A" if they are in the "editor" group but not in the "restricted" group. Due to the bug, a user in both groups might still be granted access. Similarly, an intersection condition requiring membership in both "group A" and "group B" might be satisfied even if the user is only in one group.

The root cause is a flaw in the recursive resolution of set operations within the authorization engine. The fix in v1.5.3 corrects the logic for these operators.

Vulnerable vs. Patched Code

The vulnerable code is in the core authorization evaluation logic. The specific changes are not publicly detailed, but the patch addresses the handling of exclusion and intersection operators.

Vulnerable (v1.5.0 - v1.5.2):

// Simplified vulnerable logic
func evaluateCondition(user, resource, relation) bool {
    // Incorrectly resolves exclusion and intersection
    if relation == "exclusion" {
        return evaluateCondition(user, resource, "left") && !evaluateCondition(user, resource, "right")
    }
    if relation == "intersection" {
        return evaluateCondition(user, resource, "left") || evaluateCondition(user, resource, "right")
    }
    // ...
}

Patched (v1.5.3):

// Simplified patched logic
func evaluateCondition(user, resource, relation) bool {
    if relation == "exclusion" {
        return evaluateCondition(user, resource, "left") && !evaluateCondition(user, resource, "right")
    }
    if relation == "intersection" {
        return evaluateCondition(user, resource, "left") && evaluateCondition(user, resource, "right")
    }
    // ...
}

The critical fix is in the intersection operator: the vulnerable code used || (OR) instead of && (AND), causing the bypass.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy OpenFGA v1.5.2 with a model that uses exclusion or intersection.
2. Model Example:

   {
     "type_definitions": [
       {
         "type": "document",
         "relations": {
           "viewer": {
             "union": {
               "child": [
                 { "computedUserset": { "object": "user", "relation": "editor" } },
                 { "computedUserset": { "object": "user", "relation": "admin" } }
               ]
             }
           },
           "restricted_viewer": {
             "intersection": {
               "child": [
                 { "computedUserset": { "object": "user", "relation": "viewer" } },
                 { "computedUserset": { "object": "user", "relation": "restricted" } }
               ]
             }
           }
         }
       }
     ]
   }
   

3. Exploit: As a user who is a viewer but not restricted, call the Check API for restricted_viewer. The vulnerable engine may incorrectly return true.

   curl -X POST http://target:8080/check \
     -H "Content-Type: application/json" \
     -d '{"tuple_key":{"user":"user:alice","relation":"restricted_viewer","object":"document:doc1"}}'
   

Blue Team

1. Detection: Monitor OpenFGA logs for unexpected Check or ListObjects responses, especially for models with exclusion or intersection.
2. Honeypot: Create a fake permission model with a sensitive resource that uses exclusion. Monitor for unauthorized access attempts.
3. Mitigation: Immediately upgrade to v1.5.3 or later. If upgrade is not possible, temporarily avoid using exclusion or intersection operators in permission models.

Indicators of Compromise (IOCs)

• Log Entries: Unusual Check API responses where a user is granted access to a resource they should not have access to, particularly for models with exclusion or intersection.
• Network Traffic: Repeated Check or ListObjects API calls from a single user to multiple resources, attempting to enumerate permissions.
• System Changes: No file system or registry changes expected, as this is a logic vulnerability.

Detection Engineering

YARA Rule

rule CVE_2024_31452_OpenFGA_Authorization_Bypass {
    meta:
        description = "Detects OpenFGA authorization bypass attempts via Check/ListObjects APIs"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-31452"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "check" ascii nocase
        $s2 = "list_objects" ascii nocase
        $s3 = "but not" ascii nocase
        $s4 = "and" ascii nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: OpenFGA Authorization Bypass via Exclusion/Intersection
id: 7a8b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2024-31452 in OpenFGA logs
author: Valters IT
date: 2024-10-27
logsource:
    category: application
    product: openfga
detection:
    selection:
        event: "check" OR event: "list_objects"
        model_contains: ["but not", "and"]
    condition: selection
falsepositives:
    - Legitimate use of exclusion/intersection in permission models
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31452 OpenFGA Authorization Bypass Attempt"; flow:to_server; content:"POST"; http_method; content:"/check"; http_uri; content:"but not"; http_client_body; nocase; content:"and"; http_client_body; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade OpenFGA to version 1.5.3 or later.
2. Workaround: If upgrade is not possible, avoid using exclusion (but not) and intersection (and) operators in permission models. Use alternative model designs that do not rely on these operators.
3. Monitoring: Enable detailed logging for Check and ListObjects APIs. Monitor for anomalous access patterns.
4. Validation: Review existing permission models for potential bypass scenarios. Test models with the patched version to ensure correct behavior.

Valters IT
DevSecOps & Cyber Threat Intelligence