CVE-2025-65111

Executive Summary

CVE-2025-65111 is a vulnerability in SpiceDB, an open-source database system for managing security-critical application permissions. The flaw affects the LookupPermissions API, causing it to potentially return incomplete results when a schema includes a permission defined as a union (+) of the same relation on both sides, with one side pointing to a different permission. This can lead to incorrect authorization decisions, potentially allowing unauthorized access to resources. The issue is fixed in version 1.47.1.

Supply Chain & Package Security

SpiceDB is a Go-based project. The vulnerability is in the core database logic, not in a package dependency. However, users should ensure they are using the official SpiceDB release from the GitHub repository or the Docker image authzed/spicedb. The patch is available in version 1.47.1.

CVSS Breakdown & Threat Level

The CVSS score is not provided. However, based on the description, the vulnerability has the following characteristics:

• Attack Vector (AV): Network (likely, as SpiceDB is a network service)
• Attack Complexity (AC): Low (the schema condition is specific but not complex)
• Privileges Required (PR): None (the attacker does not need prior access)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High (unauthorized access to resources)
• Integrity (I): None (data is not modified)
• Availability (A): None

Given the potential for unauthorized access, the threat level is High.

Deep Dive & Mechanics

The vulnerability lies in the LookupPermissions API of SpiceDB. When a schema defines a permission as a union of two relations that reference the same relation but with different permissions, the LookupPermissions API may fail to return all matching resources. For example:

definition user {}

definition resource {
    relation parent: user
    permission view = parent->view + parent->edit
}

In this case, view is a union of parent->view and parent->edit. If a user has edit permission on a resource but not view, the LookupPermissions API might incorrectly exclude that resource from the results. This is because the API's internal logic for handling unions with the same relation on both sides is flawed.

The fix in version 1.47.1 corrects this logic, ensuring that all resources matching the union condition are returned.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.47.1): The LookupPermissions API's union handling incorrectly deduplicates or filters results when the same relation appears on both sides of a union.

// Vulnerable pseudocode
func lookupPermissions(permission string) []Resource {
    results := []Resource{}
    for _, rel := range permission.relations {
        if rel == permission.relation {
            // Incorrectly skips or deduplicates
            continue
        }
        results = append(results, getResources(rel)...)
    }
    return results
}

Patched Code (1.47.1): The fix ensures that all branches of the union are evaluated independently and results are merged correctly.

// Patched pseudocode
func lookupPermissions(permission string) []Resource {
    results := []Resource{}
    for _, rel := range permission.relations {
        results = append(results, getResources(rel)...)
    }
    return unique(results)
}

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to:

1. Identify a SpiceDB instance with a schema that has a permission defined as a union of the same relation on both sides, with one side pointing to a different permission.
2. Craft a LookupPermissions request for that permission.
3. Observe that the API returns incomplete results, potentially allowing the attacker to access resources they should not have access to.

Lab Setup:

1. Deploy SpiceDB version 1.47.0 or earlier.
2. Create a schema with the vulnerable pattern:

   definition user {}
   definition resource {
       relation parent: user
       permission view = parent->view + parent->edit
   }
   

3. Add a user with edit permission on a resource but not view.
4. Use the LookupPermissions API to query for view permission for that user. The resource should be missing from the results.

Blue Team

To detect exploitation attempts:

1. Monitor LookupPermissions API calls for unusual patterns, especially those involving permissions with complex union definitions.
2. Log all LookupPermissions requests and compare results with expected outcomes.
3. Use the detection rules below to identify potential exploitation.

Indicators of Compromise (IOCs)

• Log Entries: LookupPermissions API calls returning incomplete results for permissions with union definitions.
• Network Traffic: Unusual patterns of LookupPermissions requests targeting specific permissions.
• System Behavior: Users gaining access to resources they should not have access to.

Detection Engineering

YARA Rule

rule CVE_2025_65111_SpiceDB_LookupPermissions {
    meta:
        description = "Detects SpiceDB LookupPermissions API calls with vulnerable union patterns"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65111"
    strings:
        $union = /permission\s+\w+\s*=\s*\w+->\w+\s*\+\s*\w+->\w+/
        $lookup = "LookupPermissions"
    condition:
        $lookup and $union
}

Sigma Rule

title: SpiceDB LookupPermissions Union Vulnerability
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects LookupPermissions API calls with vulnerable union patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: spicedb
detection:
    selection:
        api: "LookupPermissions"
        schema|contains: "->"
    condition: selection
falsepositives:
    - Legitimate use of union permissions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65111 SpiceDB LookupPermissions Union Vulnerability"; flow:to_server; content:"LookupPermissions"; http_uri; content:"->"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade SpiceDB to version 1.47.1 or later.
2. Workaround: If upgrading is not possible, review schemas for vulnerable union patterns and restructure them to avoid the same relation on both sides of a union.
3. Monitoring: Enable detailed logging for LookupPermissions API calls and monitor for anomalies.
4. Access Control: Implement additional access controls to limit the impact of incomplete LookupPermissions results.

Valters IT
Securing Digital Frontiers