CVE-2024-48909

Executive Summary

CVE-2024-48909 is a low-severity vulnerability in SpiceDB, an open-source database for fine-grained authorization. The flaw affects the LookupResources2 API, which is the default in SpiceDB 1.37.0 and opt-in since 1.35.0. When caveats are used in the evaluation path, the API may incorrectly return a CONDITIONAL permissionship with missing context, even when the context was supplied. This can lead to incorrect authorization decisions, potentially allowing unintended access or denial of service. The vulnerability has a CVSS score of 2.0, indicating low severity, but it is important to patch to ensure correct authorization behavior.

Supply Chain & Package Security

SpiceDB is a Go-based application distributed as a binary and via Docker images. The vulnerability is in the core application logic, not in a dependency. Users should ensure they are using the official SpiceDB images from Docker Hub or the GitHub Container Registry. Verify image signatures and checksums to prevent supply chain attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 2.0 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated client)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low

The low score reflects that the vulnerability only affects the correctness of authorization decisions, not direct data exposure or system compromise. However, in fine-grained authorization systems, incorrect decisions can have cascading effects.

Deep Dive & Mechanics

The LookupResources2 API is designed to efficiently find resources a subject has permission to access. When caveats (conditional expressions) are used, the API evaluates them and returns a CONDITIONAL status if the caveat's conditions are not fully met. The bug occurs when the API incorrectly marks the context as missing, even though the client provided it. This happens due to a logic error in the caveat evaluation path where the context presence check is performed before the caveat is fully evaluated.

The vulnerable code path is in the LookupResources2 handler, specifically in the function that processes caveat results. The fix in version 1.37.1 ensures that the context is properly checked after caveat evaluation, not before.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

func (h *Handler) LookupResources2(req *pb.LookupResources2Request, stream pb.SpiceDB_LookupResources2Server) error {
    // ... setup ...
    for _, caveat := range caveats {
        result := evaluateCaveat(caveat, req.Context)
        if result.Status == CONDITIONAL && !hasContext(req.Context) {
            // Bug: context check before evaluation
            return status.Error(codes.InvalidArgument, "missing context")
        }
    }
    // ...
}

Patched Code (simplified):

func (h *Handler) LookupResources2(req *pb.LookupResources2Request, stream pb.SpiceDB_LookupResources2Server) error {
    // ... setup ...
    for _, caveat := range caveats {
        result := evaluateCaveat(caveat, req.Context)
        if result.Status == CONDITIONAL && !hasContext(result.Context) {
            // Fixed: check context from evaluation result
            return status.Error(codes.InvalidArgument, "missing context")
        }
    }
    // ...
}

The fix moves the context check to after the caveat evaluation, using the context returned by the evaluation function rather than the raw request context.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker needs:

• Access to a SpiceDB instance with LookupResources2 enabled (default in 1.37.0).
• Knowledge of a caveat that returns CONDITIONAL.
• Ability to send a crafted request with valid context.

Proof of Concept (Python using grpcio):

import grpc
from spicedb_client import SpiceDBClient

channel = grpc.insecure_channel('target:50051')
client = SpiceDBClient(channel)

# Craft a request with a caveat that returns CONDITIONAL
request = {
    "resource": "document:123",
    "subject": "user:alice",
    "permission": "view",
    "context": {"required_field": "value"},
    "caveat": "some_caveat"
}

try:
    response = client.LookupResources2(request)
    # If bug is present, response may incorrectly indicate missing context
    print(response)
except Exception as e:
    print(f"Error: {e}")

Blue Team

Detection:

• Monitor SpiceDB logs for missing context errors in LookupResources2 requests.
• Alert on high frequency of CONDITIONAL responses with missing context errors.

Honeypot:

• Deploy a SpiceDB instance with LookupResources2 enabled and a dummy caveat.
• Log all requests and analyze for patterns of exploitation attempts.

Indicators of Compromise (IOCs)

• Log Entries: "missing context" errors in SpiceDB logs.
• API Responses: CONDITIONAL status with missing context field.
• Network Traffic: gRPC requests to LookupResources2 endpoint with caveat parameters.

Detection Engineering

YARA Rule

rule CVE_2024_48909_SpiceDB_LookupResources2 {
    meta:
        description = "Detects SpiceDB LookupResources2 requests with missing context"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-48909"
    strings:
        $s1 = "LookupResources2" ascii wide nocase
        $s2 = "missing context" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: SpiceDB LookupResources2 Missing Context Error
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SpiceDB LookupResources2 requests returning missing context errors
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-48909
logsource:
    product: spicedb
    service: spicedb
detection:
    selection:
        message: "missing context"
    condition: selection
falsepositives:
    - Legitimate requests with missing context
level: low

Suricata Rule

alert tcp any any -> any 50051 (msg:"CVE-2024-48909 SpiceDB LookupResources2 Missing Context"; content:"LookupResources2"; content:"missing context"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to SpiceDB 1.37.1 or later.
• If upgrade is not possible, disable LookupResources2 by setting --enable-experimental-lookup-resources=false.

Long-term:

• Implement strict input validation for caveat contexts.
• Monitor SpiceDB release notes for similar issues.
• Consider using a Web Application Firewall (WAF) to filter malformed requests.

Workaround:

• Disable LookupResources2 via the --enable-experimental-lookup-resources flag set to false.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert