Oso Cache Poisoning Fix: Cache Key Missing CheckHints in checkRequestToken

Summary of Key Vulnerability Information Vulnerability Overview Type: Cache key collision / Cache poisoning Root Cause: generates the cache key based solely on fields such as , , , and in the object, excluding . Impact: Requests with different but identical other fields map to the same cache key, causing requests with different check hints to share the cache. This can lead to incorrect check results (e.g., confusion between MEMBER and CAVETED_MEMBER), i.e., cache poisoning. Scope of Impact Affected files: - - - Affected components: All query executors relying on ( ), i.e., all permission/resource check requests using the cache key. Trigger conditions: Two requests have the same fields but different (e.g., one with a hint and one without, or different hint order). Fix Plan 1. Incorporate into the cache key calculation: In , when , append to so that different hints generate different cache keys. 2. Sort the hints: In , apply to before hashing to ensure that the order of hints does not affect the cache key (order independence). 3. New hashing method: Add a type and an method in to encode each hint string and write it into the hash. 4. Test coverage: Add test cases to to verify: - Requests with and without hints must produce different cache keys. - Requests with different hint orders must produce the same cache key (order independence). POC / Key Code Pre-fix (vulnerable) cache key generation logic ( ): Post-fix (with CheckHints included): Hint hashing implementation ( ): POC Test Case ( , verifying that different hints produce different cache keys): Core Assertions (POC verification points):

Goal Reached Thanks to every supporter — we hit 100%!

Oso Cache Poisoning Fix: Cache Key Missing CheckHints in checkRequestToken

More from this source