Authorization Decision Bypass in OpenFGA MySQL Datastore

Executive Summary

This vulnerability exists in OpenFGA versions prior to 1.18.0 when using MySQL as the datastore. It occurs because the system treats case-distinct user strings, such as 'user:Alice' and 'user:alice', as equivalent in certain database columns (tuple, changelog, and authorization_model identifier). As a result, two different authorization check requests that differ only in case can return the same response, potentially causing incorrect authorization decisions.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in OpenFGA prior to version 1.18.0 causes case-distinct user strings to be treated as equivalent in authorization decisions when using MySQL as the datastore. This can lead to incorrect authorization responses, potentially allowing unauthorized access or denial of access.

Such incorrect authorization behavior could impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data. If authorization decisions are flawed, it may result in unauthorized data access or failure to properly restrict access, thereby violating these compliance requirements.

However, the CVE description does not explicitly mention compliance impacts or specific regulatory consequences.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that authorization decisions may be incorrect due to case-insensitive comparisons of user identifiers. This means that a user might gain access to resources or permissions intended for a different user with a similar but case-distinct identifier, potentially leading to unauthorized access or privilege escalation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade OpenFGA to version 1.18.0 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from case-insensitive comparisons of user identifiers in the MySQL backend of OpenFGA prior to version 1.18.0. To detect if your system is affected, you should verify the OpenFGA version and check if the schema migration 008 has been applied.

First, confirm the OpenFGA version running on your system. If it is earlier than 1.18.0, your system is potentially vulnerable.

Next, check the collation of the identifier columns in the MySQL database tables `tuple`, `changelog`, and `authorization_model`. If these columns do not use the `utf8mb4_bin` collation, the vulnerability is present.

Suggested MySQL commands to check the collation of these columns:

• SHOW FULL COLUMNS FROM tuple;
• SHOW FULL COLUMNS FROM changelog;
• SHOW FULL COLUMNS FROM authorization_model;

Look specifically at the collation for the identifier columns in the output. If the collation is not `utf8mb4_bin`, the database is using case-insensitive comparison and is vulnerable.

Additionally, you can test authorization decisions involving user identifiers that differ only in case (e.g., `user:Alice` vs `user:alice`). If the system treats them as equivalent, the vulnerability is present.

Useful 0 Not Useful 0