CVE-2023-35930
published 2023-06-26CVE-2023-35930: SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.45%
36.0th percentile
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| authzed | spicedb | — | — |
| authzed | spicedb | — | — |
| github.com | authzed_spicedb | >= 1.22.0 < 1.22.2 | 1.22.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb
osv·2024-08-20
CVE-2023-35930 SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb
SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb
SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb
GHSA
SpiceDB's LookupResources may return partial results
ghsa·2023-06-28
CVE-2023-35930 [LOW] CWE-913 SpiceDB's LookupResources may return partial results
SpiceDB's LookupResources may return partial results
### Impact
Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected.
For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may.
Generally, `LookupResources` is not and should not be used to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release.
### Workarounds
Avoid using `LookupResources` for negative authorization decisions if using `1.22.0`.
### Patch
OSV
SpiceDB's LookupResources may return partial results
osv·2023-06-28
CVE-2023-35930 [LOW] SpiceDB's LookupResources may return partial results
SpiceDB's LookupResources may return partial results
### Impact
Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected.
For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may.
Generally, `LookupResources` is not and should not be used to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release.
### Workarounds
Avoid using `LookupResources` for negative authorization decisions if using `1.22.0`.
### Patch
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-06-26
Published