CVE-2024-38361
published 2024-06-20CVE-2024-38361: Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.40%
31.7th percentile
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned. Permission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API. This issue has been addressed in version 1.33.1. All users are advised to upgrade. There are no known workarounds for this issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| authzed | spicedb | < 1.33.1 | 1.33.1 |
| github.com | authzed_spicedb | >= 0 < 1.33.1 | 1.33.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SpiceDB exclusions can result in no permission returned when permission expected in github.com/authzed/spicedb
osv·2024-06-28
CVE-2024-38361 SpiceDB exclusions can result in no permission returned when permission expected in github.com/authzed/spicedb
SpiceDB exclusions can result in no permission returned when permission expected in github.com/authzed/spicedb
SpiceDB exclusions can result in no permission returned when permission expected in github.com/authzed/spicedb
GHSA
SpiceDB exclusions can result in no permission returned when permission expected
ghsa·2024-06-20
CVE-2024-38361 [MEDIUM] CWE-281 SpiceDB exclusions can result in no permission returned when permission expected
SpiceDB exclusions can result in no permission returned when permission expected
### Background
Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected.
For example, given this schema:
```zed
definition user {}
definition folder {
relation member: user
relation banned: user
permission view = member - banned
}
definition resource {
relation folder: folder
permission view = folder->view
}
```
If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned
### Impact
Permission is returned as `NO_PERMISSION` w
OSV
SpiceDB exclusions can result in no permission returned when permission expected
osv·2024-06-20
CVE-2024-38361 [MEDIUM] SpiceDB exclusions can result in no permission returned when permission expected
SpiceDB exclusions can result in no permission returned when permission expected
### Background
Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected.
For example, given this schema:
```zed
definition user {}
definition folder {
relation member: user
relation banned: user
permission view = member - banned
}
definition resource {
relation folder: folder
permission view = folder->view
}
```
If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned
### Impact
Permission is returned as `NO_PERMISSION` w
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/authzed/spicedb/commit/ecef31d2b266fde17eb2c3415e2ec4ceff96fbebhttps://github.com/authzed/spicedb/security/advisories/GHSA-grjv-gjgr-66g2https://github.com/authzed/spicedb/commit/ecef31d2b266fde17eb2c3415e2ec4ceff96fbebhttps://github.com/authzed/spicedb/security/advisories/GHSA-grjv-gjgr-66g2
2024-06-20
Published