Headline
GHSA-95x7-mh78-7w2r: OpenFGA subject to Information Disclosure via streamed-list-objects endpoint
Overview
During our internal security assessment, it was discovered that streamed-list-objects endpoint was not validating the authorization header resulting in the disclosure of objects in the store.
Am I Affected?
You are affected by this vulnerability if you are using openfga/openfga version v0.2.3 or prior and you are exposing the OpenFGA service to the internet.
How to fix that?
Upgrade to version v0.2.4.
Backward Compatibility
This update is backward compatible.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2022-39340
OpenFGA subject to Information Disclosure via streamed-list-objects endpoint
Moderate severity GitHub Reviewed Published Oct 25, 2022 in openfga/openfga
Vulnerability details Dependabot alerts 0
Package
gomod github.com/openfga/openfga (Go)
Affected versions
<= 0.2.3
Patched versions
0.2.4
Description
Overview
During our internal security assessment, it was discovered that streamed-list-objects endpoint was not validating the authorization header resulting in the disclosure of objects in the store.
Am I Affected?
You are affected by this vulnerability if you are using openfga/openfga version v0.2.3 or prior and you are exposing the OpenFGA service to the internet.
How to fix that?
Upgrade to version v0.2.4.
Backward Compatibility
This update is backward compatible.
References
- GHSA-95x7-mh78-7w2r
- https://nvd.nist.gov/vuln/detail/CVE-2022-39340
- openfga/openfga@779d73d
- https://github.com/openfga/openfga/releases/tag/v0.2.4
SamyGhannad published the maintainer security advisory
Oct 24, 2022
Severity
Moderate
Weaknesses
No CWEs
CVE ID
CVE-2022-39340
GHSA ID
GHSA-95x7-mh78-7w2r
Source code
openfga/openfga
Checking history
See something to contribute? Suggest improvements for this vulnerability.
Related news
OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users `openfga/openfga` versions 0.2.3 and prior who are exposing the OpenFGA service to the internet are vulnerable. Version 0.2.4 contains a patch for this issue.