CVE-2023-35933 : Security Advisory and Response

OpenFGA denial of service due to circular relationship vulnerability impacts OpenFGA versions prior to 1.1.1, allowing attackers to launch DoS attacks. Learn about the impact, technical details, and mitigation steps.

Understanding CVE-2023-35933

This vulnerability affects OpenFGA versions prior to 1.1.1, making them vulnerable to denial-of-service attacks due to circular relationship definitions in authorization models.

What is CVE-2023-35933?

OpenFGA, an open-source authorization/permission engine, is susceptible to DoS attacks when executing specific calls against models with circular relationships. If users are on versions 1.1.0 or earlier and interact with vulnerable models using

Check

or

ListObjects

calls, they are at risk.

The Impact of CVE-2023-35933

Users of OpenFGA versions prior to 1.1.1 are exposed to the risk of DoS attacks if they engage with circular relationship definitions in authorization models. Upgrading to version 1.1.1 is crucial to mitigate this vulnerability.

Technical Details of CVE-2023-35933

The vulnerability stems from a flaw in how OpenFGA handles authorization models with circular relationship definitions, allowing threat actors to exploit this flaw remotely.

Vulnerability Description

OpenFGA versions prior to 1.1.1 are vulnerable to DoS attacks triggered by executing

Check

and

ListObjects

calls against models featuring circular relationship definitions.

Affected Systems and Versions

Vendor: openfga
Product: openfga
Vulnerable Versions: < 1.1.1

Exploitation Mechanism

The vulnerability can be exploited remotely by malicious actors sending crafted requests to models containing circular relationships, resulting in denial-of-service conditions.

Mitigation and Prevention

To safeguard against CVE-2023-35933, OpenFGA users must take immediate action to secure their systems and data.

Immediate Steps to Take

Upgrade OpenFGA to version 1.1.1 to mitigate the vulnerability.

Long-Term Security Practices

Regularly update OpenFGA to the latest versions to protect against known vulnerabilities.

Patching and Updates

Stay informed about security advisories and patches released by OpenFGA to apply necessary updates promptly.