GHSA-hr9r-8phq-5x8j: OpenFGA vulnerable to denial of service due to circular relationship

Overview

OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when certain Check and ListObjects calls are executed against authorization models that contain circular relationship definitions.

Am I Affected?

You are affected by this vulnerability if you are using OpenFGA v1.1.0 or earlier, and if you are executing certain Check or ListObjects calls against a vulnerable authorization model. To see which of your models could be vulnerable to this attack, download OpenFGA v1.1.1 and run the following command:

./openfga validate-models --datastore-engine <ENGINE> --datastore-uri <URI> | jq .[] | select(.Error | contains("no entrypoints"))

replacing the variables <ENGINE> and <URI> as needed.

Fix

Upgrade to v1.1.1.

Backward Compatibility

If you are not passing an invalid authorization model (as identified by running ./openfga validate-models) as a parameter of your Check and ListObjects calls, this upgrade is backwards compatible.

Otherwise, OpenFGA v1.1.1 will start returning HTTP 400 status codes on those calls.

References

• GHSA-hr9r-8phq-5x8j
• https://nvd.nist.gov/vuln/detail/CVE-2023-35933
• openfga/openfga@087ce39
• https://openfga.dev/api/service#/Relationship%20Queries/Check
• https://openfga.dev/api/service#/Relationship%20Queries/ListObjects