CVE-2024-56323: OpenFGA Authorization Bypass

Q: What is the severity of CVE-2024-56323?

CVE-2024-56323 is classified as a high severity vulnerability due to its potential for authorization bypass.

Q: How do I fix CVE-2024-56323?

To mitigate CVE-2024-56323, you should upgrade OpenFGA to version 1.8.3 or later.

Q: Which versions of OpenFGA are affected by CVE-2024-56323?

OpenFGA versions from 1.3.8 to 1.8.2 are affected by CVE-2024-56323.

Q: What type of vulnerability is CVE-2024-56323?

CVE-2024-56323 is an authorization bypass vulnerability impacting specific Check and ListObject calls.

Q: Is my OpenFGA deployment vulnerable to CVE-2024-56323?

If you are using OpenFGA version 1.3.8 through 1.8.2, your deployment is vulnerable to CVE-2024-56323.

Published Jan 13, 2025

Updated

Overview OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.

Am I Affected? You are affected by this authorization bypass vulnerability if you are using OpenFGA v1.3.8 to v1.8.2, specifically under the following conditions: 1. Calling Check API or ListObjects with a model that uses conditions, and 2. OpenFGA is configured with caching enabled (OPENFGACHECKQUERYCACHEENABLED), and 3. Check API call or ListObjects API calls contain contextual tuples that include conditions.

Fix Upgrade to v1.8.3. This upgrade is backwards compatible.

Other sources

OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnerable to authorization bypass under the following conditions: 1. calling Check API or ListObjects with a model that uses conditions, and 2. calling Check API or ListObjects API with contextual tuples that include conditions and 3. OpenFGA is configured with caching enabled (OPENFGACHECKQUERYCACHEENABLED). Users are advised to upgrade to v1.8.3. There are no known workarounds for this vulnerability.

— MITRE

Affected Software

3 affected componentsFixes available

go/github.com/openfga/openfga>=1.3.8<1.8.3

1.8.3

OPenFGA Helm Charts>=0.1.38<0.2.19

OPenFGA OPenFGA>=1.3.8<1.8.3

Remediation

Patch Available

https://github.com/openfga/openfga/security/advisories/GHSA-32q6-rr98-cjqv

Event History

Jan 13, 2025

Advisory Published

via GitHub·07:59 PM

CVE Published

via MITRE·09:33 PM

Data Sourced

via MITRE·09:33 PM

DescriptionWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

RemedyAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-56323?

CVE-2024-56323 is classified as a high severity vulnerability due to its potential for authorization bypass.

How do I fix CVE-2024-56323?

To mitigate CVE-2024-56323, you should upgrade OpenFGA to version 1.8.3 or later.

Which versions of OpenFGA are affected by CVE-2024-56323?

OpenFGA versions from 1.3.8 to 1.8.2 are affected by CVE-2024-56323.

What type of vulnerability is CVE-2024-56323?

CVE-2024-56323 is an authorization bypass vulnerability impacting specific Check and ListObject calls.

Is my OpenFGA deployment vulnerable to CVE-2024-56323?

If you are using OpenFGA version 1.3.8 through 1.8.2, your deployment is vulnerable to CVE-2024-56323.

CVE-2024-56323: OpenFGA Authorization Bypass

Other sources

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2024-56323?

How do I fix CVE-2024-56323?

Which versions of OpenFGA are affected by CVE-2024-56323?

What type of vulnerability is CVE-2024-56323?

Is my OpenFGA deployment vulnerable to CVE-2024-56323?

Company

Resources

Contact