CVE-2022-36085 OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions
Attackers can bypass unsafe builtin restrictions in OPA by mocking functions, requiring non-default configuration to exploit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36085?
CVE-2022-36085 is a high-severity vulnerability in open-policy-agent opa, published on 8 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn’t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.
Which versions are affected by CVE-2022-36085?
3 open source packages ship an affected version, including github.com/open-policy-agent/opa. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/open-policy-agent/opa Go | From 0.40.0 | 0.43.1 |
github.com/open-policy-agent/opa Go | From 0.40.0 | 0.43.1 |
github.com/open-policy-agent/opa Go | From 0.40.0 | 0.44.0 |
Products include Openpolicyagent Open Policy Agent.
How do I fix CVE-2022-36085?
Upgrade github.com/open-policy-agent/opa to a fixed version for your release line: 0.43.1 or 0.44.0.
Is CVE-2022-36085 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-36085 exists.
Other vulnerabilities in open-policy-agent opa
Sources
Also known as GHSA-f524-rf33-2jjr, GO-2022-0978.