CVE-2022-36085: OPA Compiler Bypass Of WithUnsafeBuiltins Using "with" Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f524-rf33-2jjr",
  "modified" : "2024-01-23T20:38:00Z",
  "published" : "2022-09-16T17:42:47Z",
  "aliases" : [ "CVE-2022-36085" ],
  "summary" : "OPA Compiler: Bypass of WithUnsafeBuiltins using \"with\" keyword to mock functions",
  "details" : "### Impact\n\nThe Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn’t taken into account by `WithUnsafeBuiltins`.\n\nThe same method is exposed via `rego.UnsafeBuiltins` in the `github.com/open-policy-agent/opa/rego` package.\n\nWhen provided e.g. the `http.send` built-in function to `WithUnsafeBuiltins`, the following policy would still compile, and call the `http.send` function with the arguments provided to the `is_object` function when evaluated:\n\n```rego\npackage policy\n\nfoo := is_object({\n    \"method\": \"get\", \n    \"url\": \"https://www.openpolicyagent.org\"\n})\n\nallow := r {\n    r := foo with is_object as http.send\n}\n```\n\nBoth built-in functions and user provided (i.e. custom) functions are mockable using this construct.\n\nIn addition to `http.send`, the `opa.runtime` built-in function is commonly considered unsafe in integrations where policy provided by untrusted parties is evaluated, as it risks exposing configuration, or environment variables, potentially carrying sensitive information.\n\n#### Affected Users\n\n**All of these conditions have to be met** to create an adverse effect:\n\n* Use the Go API for policy evaluation (not the OPA server, or the Go SDK)\n* Make use of the `WithUnsafeBuiltins` method in order to deny certain built-in functions, like e.g. `http.send`, from being used in policy evaluation.\n* Allow policy evaluation of policies provided by untrusted parties.\n* The policies evaluated include the `with` keyword to rewrite/mock a built-in, or custom, function to that of another built-in function, such as `http.send`.\n\n**Additionally, the OPA Query API** is affected:\n* If the OPA [Query API](https://www.openpolicyagent.org/docs/latest/rest-api/#query-api) is exposed to the public, and it is relied on `http.send` to be unavailable in that context. Exposing the OPA API to the public without proper [authentication and authorization](https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization) in place is generally advised against.\n\n### Patches\nv0.43.1, v0.44.0\n\n### Workarounds\n\nThe `WithUnsafeBuiltins`  function has been considered deprecated since the introduction of the [capabilities](https://www.openpolicyagent.org/docs/latest/deployments/#capabilities) feature in OPA v0.23.0 . While the function was commented as deprecated, the format of the comment was however not following the [convention](https://zchee.github.io/golang-wiki/Deprecated/) for deprecated functions, and might not have been picked up by tooling like editors. This has now been fixed. Users are still encouraged to use the capabilities feature over the deprecated `WithUnsafeBuiltins` function.\n\n**If you cannot upgrade**, consider using capabilities instead:\n\nCode like this using the `github.com/open-policy-agent/opa/ast` package:\n```go\n// VULNERABLE with OPA <= 0.43.0\nunsafeBuiltins := map[string]struct{}{\n\tast.HTTPSend.Name: struct{}{},\n}\ncompiler := ast.NewCompiler().WithUnsafeBuiltins(unsafeBuiltins)\n```\n\nneeds to be changed to this:\n```go\ncaps := ast.CapabilitiesForThisVersion()\nvar j int\nfor i, bi := range caps.Builtins {\n\tif bi.Name == ast.HTTPSend.Name {\n\t\tj = i\n\t\tbreak\n\t}\n}\ncaps.Builtins[j] = caps.Builtins[len(caps.Builtins)-1] // put last element into position j\ncaps.Builtins = caps.Builtins[:len(caps.Builtins)-1]   // truncate slice\n\ncompiler := ast.NewCompiler().WithCapabilities(caps)\n```\n\nWhen using the `github.com/open-policy-agent/opa/rego` package:\n\n```go\n// VULNERABLE with OPA <= 0.43.0\nr := rego.New(\n\t// other options omitted\n\trego.UnsafeBuiltins(map[string]struct{}{ast.HTTPSend.Name: struct{}{}}),\n)\n```\n\nneeds to be changed to\n```go\nr := rego.New(\n\t// other options omitted\n\trego.Capabilities(caps),\n)\n```\nwith `caps` defined above.\n\nNote that in the process, some error messages will change: `http.send` in this example will no longer be \"unsafe\" and thus forbidden, but it will simply become an \"unknown function\".\n\n### References\n\n* Fix commit on `main`: https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823\n* Fix commit in 0.43.1 release: https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8, release page for 0.43.1: https://github.com/open-policy-agent/opa/releases/tag/v0.43.1\n* Function mocking feature introduced in https://github.com/open-policy-agent/opa/pull/4540 and https://github.com/open-policy-agent/opa/pull/4616 \n* Documentation on the [capabilities](https://www.openpolicyagent.org/docs/latest/deployments/#capabilities) feature, which is the preferred way of providing a list of allowed built-in functions. The capabilities feature is **not** affected by this vulnerability.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [Community Discussions](https://github.com/open-policy-agent/community/discussions/categories/opa-and-rego)\n* Ask in Slack: https://slack.openpolicyagent.org/\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/open-policy-agent/opa"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.40.0"
      }, {
        "fixed" : "0.43.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-36085"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-policy-agent/opa/pull/4540"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-policy-agent/opa/pull/4616"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/open-policy-agent/opa"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2022-0978"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-09-16T17:42:47Z",
    "nvd_published_at" : "2022-09-08T14:15:00Z"
  }
}