GHSA-7p8f-8hjm-wm92

Source

https://github.com/advisories/GHSA-7p8f-8hjm-wm92

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-7p8f-8hjm-wm92/GHSA-7p8f-8hjm-wm92.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-7p8f-8hjm-wm92

Aliases

Published

2022-01-13T15:05:41Z

Modified

2024-08-21T14:57:21.467438Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Lookup operations do not take into account wildcards in SpiceDB

Details

Impact

Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion.

For example, given schema:

definition user {}

definition resource {
   relation viewer: user
   relation banned: user | user:*
   permission view = viewer - banned
}

If user:* is placed into the banned relation for a particular resource, view should return false for all resources. in v1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in the banned wildcard being ignored in the exclusion.

Workarounds

Don't make use of wildcards on the right side of intersections or within exclusions.

References

https://github.com/authzed/spicedb/issues/358

For more information

If you have any questions or comments about this advisory: * Open an issue in SpiceDB * Ask a question in the SpiceDB Discord

Database specific

{
    "severity": "HIGH",
    "github_reviewed_at": "2022-01-11T21:06:45Z",
    "cwe_ids": [
        "CWE-155",
        "CWE-20"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2022-01-11T22:15:00Z"
}

GHSA-7p8f-8hjm-wm92

Impact

Workarounds

References

For more information

Affected packages

Go / github.com/authzed/spicedb

Package

Affected ranges

Affected versions

1.*