CVE-2024-42473

Executive Summary

CVE-2024-42473 is a critical authorization bypass vulnerability in OpenFGA versions 1.5.7 and 1.5.8. The flaw allows an attacker to bypass permission checks when the Check API is called with a model that uses but not and from expressions combined with a userset. This can lead to unauthorized access to resources that should be denied. The vendor recommends downgrading to version 1.5.6, which is backward compatible. No official patch is available at the time of publication.

Supply Chain & Package Security

OpenFGA is a Go-based authorization engine. The vulnerability affects the core authorization logic, not a specific package manager. However, organizations using OpenFGA as a dependency in their Go projects should immediately downgrade to v1.5.6 to mitigate the risk.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None

The vulnerability is easily exploitable remotely without authentication, making it a high-priority threat for any organization using the affected versions.

Deep Dive & Mechanics

The vulnerability lies in the Check API's handling of models containing but not and from expressions with a userset. In OpenFGA, the but not operator is used to exclude certain users or sets from a permission, while from is used to traverse relationships. When these are combined with a userset (a set of users defined by a relationship), the authorization engine incorrectly evaluates the permission, potentially granting access to unauthorized users.

The flaw is in the evaluation logic where the intersection of but not and from is not properly computed when a userset is involved. This allows an attacker to craft a request that bypasses the intended access controls.

Vulnerable vs. Patched Code

Vulnerable Code (v1.5.7/v1.5.8): The vulnerable code likely resides in the Check API handler where the but not and from expressions are evaluated. The exact code is not publicly available, but the logic flaw can be described as:

// Vulnerable pseudocode
func checkAccess(user, resource, relation) bool {
    // Evaluate 'from' expression
    fromSet := getFromSet(resource, relation)
    // Evaluate 'but not' expression
    butNotSet := getButNotSet(resource, relation)
    // Incorrectly combine sets
    allowedSet := fromSet.Difference(butNotSet)
    // This does not properly handle usersets within the 'but not' expression
    return allowedSet.Contains(user)
}

Patched Code (v1.5.6): The patched version correctly handles the intersection of but not and from with usersets:

// Patched pseudocode
func checkAccess(user, resource, relation) bool {
    // Evaluate 'from' expression
    fromSet := getFromSet(resource, relation)
    // Evaluate 'but not' expression, properly resolving usersets
    butNotSet := getButNotSet(resource, relation)
    // Correctly compute the difference
    allowedSet := fromSet.Difference(butNotSet)
    return allowedSet.Contains(user)
}

The key difference is in the getButNotSet function, which in the vulnerable version does not resolve usersets correctly.

Exploitation & Lab Setup

Red Team

Prerequisites:

• OpenFGA v1.5.7 or v1.5.8 running with a model that uses but not and from expressions with a userset.
• Network access to the OpenFGA API.

Exploitation Steps:

1. Identify the OpenFGA instance and its model.
2. Craft a Check API request that exploits the but not and from combination.
3. Send the request to the /check endpoint.

Example request:

{
  "tuple_key": {
    "user": "user:attacker",
    "relation": "viewer",
    "object": "document:secret"
  },
  "contextual_tuples": {
    "tuple_keys": [
      {
        "user": "user:attacker",
        "relation": "member",
        "object": "group:admins"
      }
    ]
  }
}

If the model has a rule like viewer from group:admins but not user:attacker, the vulnerable version may incorrectly grant access.

Blue Team

Detection:

• Monitor for unusual Check API requests that involve but not and from expressions.
• Look for requests where the user field is part of a but not clause but still receives a positive response.

Mitigation:

• Immediately downgrade to OpenFGA v1.5.6.
• Implement network segmentation to limit access to the OpenFGA API.
• Enable detailed logging for the Check API.

Indicators of Compromise (IOCs)

• Network: Unusual Check API requests with but not and from expressions.
• Logs: Check API responses that grant access to users who should be denied based on but not rules.
• System: OpenFGA version 1.5.7 or 1.5.8 running.

Detection Engineering

YARA Rule

rule CVE_2024_42473_OpenFGA_Check_API {
    meta:
        description = "Detects OpenFGA Check API requests exploiting CVE-2024-42473"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-42473"
    strings:
        $check_endpoint = "/check"
        $but_not = "but not"
        $from = "from"
        $userset = "userset"
    condition:
        all of them
}

Sigma Rule

title: OpenFGA Check API Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-42473 in OpenFGA
author: Valters IT
logsource:
    category: application
    product: openfga
detection:
    selection:
        http.method: POST
        http.url: /check
        http.body|contains: 
            - "but not"
            - "from"
            - "userset"
    condition: selection
falsepositives:
    - Legitimate use of complex models
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-42473 OpenFGA Check API Exploit"; flow:to_server; content:"POST"; http_method; content:"/check"; http_uri; content:"but not"; http_client_body; content:"from"; http_client_body; content:"userset"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Action:

• Downgrade OpenFGA to version 1.5.6. This version is backward compatible and does not contain the vulnerability.

Long-term Fix:

• Monitor OpenFGA releases for an official patch. The maintainers have stated a patch is planned for a future release.

Workarounds:

• If downgrading is not possible, avoid using models that combine but not and from expressions with usersets.
• Implement additional access controls at the application layer to compensate.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Enable detailed logging for the Check API and review logs for anomalies.

Valters IT
Securing Digital Frontiers