Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03cDhmLThoam0td205Ms0h7w
Lookup operations do not take into account wildcards in SpiceDB
Impact
Any user making use of a wildcard relationship under the right hand branch of an exclusion
or within an intersection
operation will see Lookup
/LookupResources
return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion.
For example, given schema:
definition user {}
definition resource {
relation viewer: user
relation banned: user | user:*
permission view = viewer - banned
}
If user:*
is placed into the banned
relation for a particular resource, view
should return false for all resources. in v1.3.0
, the wildcard is ignored entirely in lookup's dispatch, resulting in the banned
wildcard being ignored in the exclusion.
Workarounds
Don't make use of wildcards on the right side of intersections or within exclusions.
References
https://github.com/authzed/spicedb/issues/358
For more information
If you have any questions or comments about this advisory:
- Open an issue in SpiceDB
- Ask a question in the SpiceDB Discord
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03cDhmLThoam0td205Ms0h7w
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago
CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Identifiers: GHSA-7p8f-8hjm-wm92, CVE-2022-21646
References:
- https://github.com/authzed/spicedb/security/advisories/GHSA-7p8f-8hjm-wm92
- https://nvd.nist.gov/vuln/detail/CVE-2022-21646
- https://github.com/authzed/spicedb/issues/358
- https://github.com/authzed/spicedb/commit/15bba2e2d2a4bda336a37a7fe8ef8a35028cd970
- https://github.com/authzed/spicedb/releases/tag/v1.4.0
- https://github.com/advisories/GHSA-7p8f-8hjm-wm92
Blast Radius: 10.0
Affected Packages
go:github.com/authzed/spicedb
Dependent packages: 9Dependent repositories: 17
Downloads:
Affected Version Ranges: = 1.3.0
Fixed in: 1.4.0
All affected versions: 1.3.0
All unaffected versions: 0.0.1, 0.0.2, 0.0.3, 1.0.0, 1.1.0, 1.2.0, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.7.1, 1.8.0, 1.9.0, 1.10.0, 1.11.0, 1.12.0, 1.13.0, 1.14.0, 1.14.1, 1.15.0, 1.16.0, 1.16.1, 1.16.2, 1.17.0, 1.18.0, 1.18.1, 1.19.0, 1.19.1, 1.20.0, 1.21.0, 1.22.0, 1.22.1, 1.22.2, 1.23.0, 1.23.1, 1.24.0, 1.25.0, 1.26.0, 1.27.0, 1.28.0, 1.29.0, 1.29.1, 1.29.2, 1.29.4, 1.29.5, 1.30.0, 1.30.1, 1.31.0