CVE-2022-21646 Lookup operations do not take into account wildcards in SpiceDB

2022-01-1121:50:10

CWE-155

CWE-20

GitHub_M

www.cve.org

spicedb

wildcard

vulnerability

lookup

exclusion

intersection

patch

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

38.1%

JSON

SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as “accessible” if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In v1.3.0, the wildcard is ignored entirely in lookup’s dispatch, resulting in the banned wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don’t make use of wildcards on the right side of intersections or within exclusions.

CNA Affected

[
  {
    "product": "spicedb",
    "vendor": "authzed",
    "versions": [
      {
        "status": "affected",
        "version": "= 1.3.0"
      }
    ]
  }
]