GHSA-6m8w-jc87-6cr7: OS Command Injection

First published: Thu May 01 2025(Updated: )

### Impact When run as a server, OPA exposes an HTTP[ Data API](https://www.openpolicyagent.org/docs/latest/rest-api/#data-api) for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document [reference](https://www.openpolicyagent.org/docs/latest/policy-language/#references) is constructed from the requested path. This query is then used for policy evaluation. A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack. **Users are only impacted if all of the following apply:** * OPA is deployed as a standalone server (rather than being used as a Go library) * The OPA server is exposed outside of the local host in an untrusted environment. * The configured [authorization policy](https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization) does not do exact matching of the `input.path` attribute when deciding if the request should be allowed. **or, if all of the following apply:** * OPA is deployed as a standalone server. * The service connecting to OPA allows 3rd parties to insert unsanitised text into the path of the HTTP request to OPA’s Data API. **Note:** With **no** Authorization Policy configured for restricting API access (the default configuration), the RESTful Data API provides access for managing Rego policies; and the RESTful Query API facilitates advanced queries. Full access to these APIs provides both simpler, and broader access than what the security issue describes here can facilitate. As such, OPA servers exposed to a network are **not** considered affected by the attack described here if they are knowingly not restricting access through an Authorization Policy. ### Patches Fixed in OPA v1.4.0. ### Workarounds #### Don’t publicly expose OPA’s RESTful APIs #### Unless necessary for production reasons, network access to OPA’s RESTful APIs should be limited to `localhost` and/or trusted networks. Since OPA v1.0, unless otherwise configured, the server listener defaults to `localhost`. #### Enable Authentication to Only Allow Access to Trusted Clients #### A configured [authentication](https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization) scheme is a requirement when OPA is exposed in an untrusted environment. While requiring authentication alone doesn’t mitigate this attack, it effectively reduces the scope from untrusted clients to trusted clients. #### Perform Path Validation Using OPA’s Authorization Policy Functionality #### OPA can be configured to use an [Authorization Policy](https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization) to validate all incoming requests. By authoring the Authorization Policy to only accept paths corresponding to expected Rego package references, this attack can be fully mitigated. The HTTP path in a Data API request is of the format `/v1/data/{path:.+}` (`/v0/data/{path:.+}`, for the v0 Data API), where `data/{path:.+}` directly corresponds to a reference to a virtual document, and a prefix of `{path:.+}` corresponds to a Rego `package` declaration. E.g. the HTTP path `v1/data/do/re/mi` corresponds to the data reference `data.do.re.mi`, where `do.re` is the package and `mi` is the rule in the following Rego module: ```rego package do.re mi if { ... } ``` Unless otherwise [configured](https://www.openpolicyagent.org/docs/latest/configuration/#miscellaneous), OPA will use the rule at `data.system.authz.allow` as Authorization Policy. Authorization is enabled by starting OPA with the `--authorization=basic` flag, and the Authorization policy must be made available to the OPA runtime either through a bundle (via the `--bundle` flag or through [discovery](https://www.openpolicyagent.org/docs/latest/management-discovery/)) or as an individual module via the command-line. A trivial Authorization Policy example: ```rego package system.authz allowed_paths := [ ["v1", "data", "policy1", "allow"], ["v1", "data", "policy2", "allow"], ... ] allow if { input.path in allowed_paths } ``` **Note:** configuring an Authorization Policy in OPA isn't the only way to protect against malicious request paths. Path validation and sanitisation can also be performed by connecting clients and 3rd party intermediaries, such as API gateways, reverse proxies, etc.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/weakness
• agent/references
• agent/source
• agent/softwarecombine
• agent/first-publish-date
• agent/type
• agent/description
• agent/tags
• agent/event
• agent/last-modified-date
• collector/github-advisory-latest
• source/GitHub
• alias/GHSA-6m8w-jc87-6cr7
• alias/CVE-2025-46569
• agent/software-canonical-lookup
• package-manager/go