-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/open-policy-agent/opa | go | < 0.68.0 | 0.68.0 |
Miggo AIRoot Cause AnalysisThe vulnerability description states that improper input validation allowed a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or OPA Go library functions. The provided commit 10f4d553e6bb6ae9c69611ecdd9a77dda857070e introduces a new function checkForUNCPath and adds calls to it in three existing functions within loader/loader.go: fileLoader.AsBundle, GetBundleDirectoryLoaderFS, and allRec. These functions are responsible for loading files and bundles based on a path argument. The patch explicitly adds a check to prevent the use of UNC paths, which directly addresses the described vulnerability. Therefore, these three functions, in their state before this patch, were vulnerable as they would attempt to process UNC paths, leading to the SMB force-authentication issue when a malicious SMB share was provided.
KEV Misses 88% of Exploited CVEs- Get the report