CVE-2023-35930

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/authzed/spicedb/pull/1397	Patch Vendor Advisory
https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:authzed:spicedb:1.22.0:-:*:*:*:*:*:*

History

No history.

Information

Published : 2023-06-26 20:15

Updated : 2023-07-06 18:17

NVD link : CVE-2023-35930

Mitre link : CVE-2023-35930

CVE.ORG link : CVE-2023-35930

JSON object : View

Products Affected

authzed

spicedb

CWE

CWE-913

Improper Control of Dynamically-Managed Code Resources

{"id": "CVE-2023-35930", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2023-06-26T20:15:10.507", "references": [{"url": "https://github.com/authzed/spicedb/pull/1397", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-913"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions."}, {"lang": "es", "value": "SpiceDB es un sistema de base de datos de c\u00f3digo abierto, inspirado en Google Zanzibar, para crear y gestionar permisos de aplicaciones cr\u00edticos para la seguridad. Cualquier usuario que tome una decisi\u00f3n de autorizaci\u00f3n negativa basada en los resultados de una solicitud \"LookupResources\" con la versi\u00f3n 1.22.0 se ve afectado. Por ejemplo, si se utiliza \"LookupResources\" para buscar una lista de recursos a los que permitir el acceso, no pasa nada: algunos sujetos que deber\u00edan tener acceso a un recurso pueden no tenerlo. Pero si en cambio se utiliza \"LookupResources\" para encontrar una lista de recursos prohibidos, entonces algunos usuarios que no deber\u00edan tener acceso podr\u00edan tenerlo. En general, \"LookupResources\" no sirve ni deberia servir para bloquear el acceso de esta forma: para eso est\u00e1 la API \"Check\". Adem\u00e1s, la versi\u00f3n 1.22.0 ha incluido una advertencia sobre este error desde su lanzamiento inicial. Se recomienda a los usuarios que actualicen a la versi\u00f3n 1.22.2. Los usuarios que no puedan actualizarse deber\u00edan evitar el uso de \"LookupResources\" para decisiones de autorizaci\u00f3n negativas. "}], "lastModified": "2023-07-06T18:17:12.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:authzed:spicedb:1.22.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0806B94-B9EA-450F-B6F7-FC89D60F39FD"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}