Impact
When run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation.
A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack.
Users are only impacted if all of the following apply:
- OPA is deployed as a standalone server (rather than being used as a Go library)
- The OPA server is exposed outside of the local host in an untrusted environment.
- The configured authorization policy does not do exact matching of the
input.path attribute when deciding if the request should be allowed.
or, if all of the following apply:
- OPA is deployed as a standalone server.
- The service connecting to OPA allows 3rd parties to insert unsanitised text into the path of the HTTP request to OPA’s Data API.
Note: With no Authorization Policy configured for restricting API access (the default configuration), the RESTful Data API provides access for managing Rego policies; and the RESTful Query API facilitates advanced queries. Full access to these APIs provides both simpler, and broader access than what the security issue describes here can facilitate. As such, OPA servers exposed to a network are not considered affected by the attack described here if they are knowingly not restricting access through an Authorization Policy.
Patches
Fixed in OPA v1.4.0.
Workarounds
Don’t publicly expose OPA’s RESTful APIs
Unless necessary for production reasons, network access to OPA’s RESTful APIs should be limited to localhost and/or trusted networks.
Since OPA v1.0, unless otherwise configured, the server listener defaults to localhost.
Enable Authentication to Only Allow Access to Trusted Clients
A configured authentication scheme is a requirement when OPA is exposed in an untrusted environment. While requiring authentication alone doesn’t mitigate this attack, it effectively reduces the scope from untrusted clients to trusted clients.
Perform Path Validation Using OPA’s Authorization Policy Functionality
OPA can be configured to use an Authorization Policy to validate all incoming requests.
By authoring the Authorization Policy to only accept paths corresponding to expected Rego package references, this attack can be fully mitigated.
The HTTP path in a Data API request is of the format /v1/data/{path:.+} (/v0/data/{path:.+}, for the v0 Data API), where data/{path:.+} directly corresponds to a reference to a virtual document, and a prefix of {path:.+} corresponds to a Rego package declaration.
E.g. the HTTP path v1/data/do/re/mi corresponds to the data reference data.do.re.mi, where do.re is the package and mi is the rule in the following Rego module:
package do.re
mi if {
...
}Unless otherwise configured, OPA will use the rule at data.system.authz.allow as Authorization Policy. Authorization is enabled by starting OPA with the --authorization=basic flag, and the Authorization policy must be made available to the OPA runtime either through a bundle (via the --bundle flag or through discovery) or as an individual module via the command-line.
A trivial Authorization Policy example:
package system.authz
allowed_paths := [
["v1", "data", "policy1", "allow"],
["v1", "data", "policy2", "allow"],
...
]
allow if {
input.path in allowed_paths
}Note: configuring an Authorization Policy in OPA isn't the only way to protect against malicious request paths. Path validation and sanitisation can also be performed by connecting clients and 3rd party intermediaries, such as API gateways, reverse proxies, etc.
References
Impact
When run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation.
A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack.
Users are only impacted if all of the following apply:
input.pathattribute when deciding if the request should be allowed.or, if all of the following apply:
Note: With no Authorization Policy configured for restricting API access (the default configuration), the RESTful Data API provides access for managing Rego policies; and the RESTful Query API facilitates advanced queries. Full access to these APIs provides both simpler, and broader access than what the security issue describes here can facilitate. As such, OPA servers exposed to a network are not considered affected by the attack described here if they are knowingly not restricting access through an Authorization Policy.
Patches
Fixed in OPA v1.4.0.
Workarounds
Don’t publicly expose OPA’s RESTful APIs
Unless necessary for production reasons, network access to OPA’s RESTful APIs should be limited to
localhostand/or trusted networks.Since OPA v1.0, unless otherwise configured, the server listener defaults to
localhost.Enable Authentication to Only Allow Access to Trusted Clients
A configured authentication scheme is a requirement when OPA is exposed in an untrusted environment. While requiring authentication alone doesn’t mitigate this attack, it effectively reduces the scope from untrusted clients to trusted clients.
Perform Path Validation Using OPA’s Authorization Policy Functionality
OPA can be configured to use an Authorization Policy to validate all incoming requests.
By authoring the Authorization Policy to only accept paths corresponding to expected Rego package references, this attack can be fully mitigated.
The HTTP path in a Data API request is of the format
/v1/data/{path:.+}(/v0/data/{path:.+}, for the v0 Data API), wheredata/{path:.+}directly corresponds to a reference to a virtual document, and a prefix of{path:.+}corresponds to a Regopackagedeclaration.E.g. the HTTP path
v1/data/do/re/micorresponds to the data referencedata.do.re.mi, wheredo.reis the package andmiis the rule in the following Rego module:Unless otherwise configured, OPA will use the rule at
data.system.authz.allowas Authorization Policy. Authorization is enabled by starting OPA with the--authorization=basicflag, and the Authorization policy must be made available to the OPA runtime either through a bundle (via the--bundleflag or through discovery) or as an individual module via the command-line.A trivial Authorization Policy example:
Note: configuring an Authorization Policy in OPA isn't the only way to protect against malicious request paths. Path validation and sanitisation can also be performed by connecting clients and 3rd party intermediaries, such as API gateways, reverse proxies, etc.
References