CVE-2024-32001

Executive Summary

CVE-2024-32001 is a low-severity (CVSS 2.2) logic vulnerability in SpiceDB, a graph database for access control. The flaw occurs when a schema uses a relation with the same subject type multiple times (e.g., relation folder: folder | folder#parent) combined with an arrow (e.g., folder->view). Under these conditions, the LookupSubjects API may return incomplete results, only returning subjects found under one of the subject types instead of the union of both. This can lead to incorrect negative authorization decisions if an authorization system relies on LookupSubjects to deny access. The vulnerability is patched in version 1.30.1.

Supply Chain & Package Security

SpiceDB is a Go-based project distributed as a Docker image and a Go binary. The vulnerability is in the core logic of the LookupSubjects API, not in a dependency. However, users should verify the integrity of their SpiceDB binaries or Docker images after upgrading to v1.30.1.

CVSS Breakdown & Threat Level

• CVSS Score: 2.2 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network
• Attack Complexity: High (requires specific schema and relationship conditions)
• Privileges Required: Low (attacker needs ability to create relationships or influence schema)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low (incorrect authorization decisions could lead to denial of service for legitimate users)

Deep Dive & Mechanics

The vulnerability lies in the LookupSubjects API when processing a relation that uses the same subject type in multiple positions. For example:

definition folder {
    relation parent: folder
    relation viewer: folder | folder#parent
    permission view = viewer
}

When a LookupSubjects request is made for folder->view, the API should return all subjects that are either directly a folder or are a folder#parent. However, due to a bug in the subject set resolution logic, only one of these two sets is returned. This happens because the code incorrectly deduplicates or merges subject sets when the same subject type appears multiple times in a relation definition.

The bug is triggered when:

1. The same subject type is used multiple times in a relation (e.g., folder | folder#parent).
2. Relationships exist for both subject types (e.g., document:1 viewer: folder:2 and document:1 viewer: folder:2#parent).
3. An arrow is used over the relation (e.g., folder->view).

Vulnerable vs. Patched Code

Vulnerable (pre-1.30.1): The LookupSubjects handler in internal/services/v1/lookupsubjects.go incorrectly handles subject sets when the same subject type appears multiple times. The code may short-circuit or incorrectly merge results.

// Vulnerable pseudocode
func (s *LookupSubjectsServer) LookupSubjects(ctx context.Context, req *pb.LookupSubjectsRequest) (*pb.LookupSubjectsResponse, error) {
    // ... setup ...
    for _, subjectType := range subjectTypes {
        // Bug: When same subjectType appears twice, the second iteration may overwrite the first
        results, err := s.resolveSubjectSet(ctx, subjectType, ...)
        // ... merge results incorrectly ...
    }
}

Patched (v1.30.1): The fix ensures that all subject types are properly unioned, even when the same type appears multiple times.

// Patched pseudocode
func (s *LookupSubjectsServer) LookupSubjects(ctx context.Context, req *pb.LookupSubjectsRequest) (*pb.LookupSubjectsResponse, error) {
    // ... setup ...
    allResults := make(map[string]*pb.Subject)
    for _, subjectType := range subjectTypes {
        results, err := s.resolveSubjectSet(ctx, subjectType, ...)
        // Properly union results without overwriting
        for _, result := range results {
            allResults[result.SubjectId] = result
        }
    }
    // ... return unioned results ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a SpiceDB instance with a schema that uses the same subject type multiple times in a relation.
• Ability to create relationships or influence the schema.

Exploitation Steps:

1. Identify a schema with a relation like relation viewer: folder | folder#parent.
2. Create relationships: document:1 viewer: folder:2 and document:1 viewer: folder:2#parent.
3. Perform a LookupSubjects request for folder->view on document:1.
4. Observe that only one subject (either folder:2 or folder:2#parent) is returned, not both.
5. Use this incomplete result to make a negative authorization decision (e.g., deny access to folder:2#parent).

Example gRPC call:

LookupSubjectsRequest {
    resource: "document:1"
    permission: "view"
    subject_type: "folder"
}

Blue Team

Detection:

• Monitor for LookupSubjects requests that return fewer results than expected.
• Alert on schemas that use the same subject type multiple times in a relation.

Mitigation:

• Upgrade to SpiceDB v1.30.1.
• Avoid using LookupSubjects for negative authorization decisions.
• Review schemas for patterns like relation x: type | type#relation.

Indicators of Compromise (IOCs)

• Log Entries: Look for LookupSubjects requests with incomplete results.
• Schema Patterns: Relations with the same subject type multiple times (e.g., relation viewer: folder | folder#parent).
• API Calls: LookupSubjects requests with subject_type matching a type used multiple times in a relation.

Detection Engineering

YARA Rule

rule CVE_2024_32001_SpiceDB_LookupSubjects {
    meta:
        description = "Detects SpiceDB LookupSubjects vulnerability patterns"
        author = "Valters IT"
        date = "2024-05-20"
        cve = "CVE-2024-32001"
    strings:
        $schema_pattern = /relation\s+\w+\s*:\s*\w+\s*\|\s*\w+#\w+/ nocase
        $lookup_subjects = "LookupSubjects"
    condition:
        $lookup_subjects and #schema_pattern >= 2
}

Sigma Rule

title: SpiceDB LookupSubjects Incomplete Results
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2024-32001 in SpiceDB
author: Valters IT
logsource:
    product: spicedb
    service: audit
detection:
    selection:
        EventID: "LookupSubjects"
        SchemaPattern: "relation *: * | *#*"
    condition: selection
falsepositives:
    - Legitimate use of complex schemas
level: low

Suricata Rule

alert tcp any any -> any 50051 (msg:"CVE-2024-32001 SpiceDB LookupSubjects Exploit"; flow:to_server; content:"LookupSubjects"; content:"subject_type"; content:"folder"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade SpiceDB to version 1.30.1 or later.
• If upgrade is not possible, avoid using LookupSubjects for negative authorization decisions.

Long-term:

• Review all schemas for patterns that use the same subject type multiple times in a relation.
• Implement monitoring for LookupSubjects API calls that return unexpected results.
• Consider using Check or LookupResources instead of LookupSubjects for authorization decisions.

Patch Details:

• Upgrade to SpiceDB v1.30.1.
• The patch is available at: https://github.com/authzed/spicedb/releases/tag/v1.30.1

Valters IT