VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 30, 2024· Updated Aug 30, 2024

OPA SMB Force-Authentication

CVE-2024-8260

Description

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A SMB force-authentication vulnerability in OPA for Windows allows attackers to leak Net-NTLMv2 hashes by passing a malicious UNC path instead of a Rego file.

Vulnerability

Overview

CVE-2024-8260 is an SMB force-authentication vulnerability affecting all versions of Open Policy Agent (OPA) for Windows prior to v0.68.0. The root cause is improper input validation, which permits a user to supply an arbitrary SMB share (UNC path) in place of a legitimate Rego file when using the OPA CLI or calling certain OPA Go library functions [1][4].

Exploitation

Details

Exploitation requires an initial foothold in the environment or social engineering to trick a user into executing the OPA CLI with a malicious UNC path as an argument. Affected CLI commands include opa eval -d, opa eval --bundle, and opa run -s. Additionally, Go-based services that integrate OPA may be vulnerable if they pass user-controlled input to functions such as Rego.Load() or Rego.LoadBundle() [4]. The attack is more likely if the vulnerable function receives input from an untrusted source, especially on internet-facing platforms.

Impact

A successful exploit forces the Windows device running OPA to initiate outbound SMB traffic to an attacker-controlled server, leaking the Net-NTLMv2 hash of the currently logged-in user. The attacker can then relay this hash to authenticate against other systems supporting NTLMv2 or perform offline password cracking [4].

Mitigation

The vulnerability is fixed in OPA v0.68.0 and later. Users on Windows should upgrade immediately to this version or apply appropriate workarounds, such as restricting outbound SMB traffic on port 445 [3][4].

References
  1. NVD - CVE-2024-8260
  2. Release v0.68.0 · open-policy-agent/opa
  3. OPA SMB Force-Authentication

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/open-policy-agent/opaGo
< 0.68.00.68.0

Affected products

114

Patches

1
10f4d553e6bb

loader: Block reading of UNC paths

https://github.com/open-policy-agent/opaAshutosh NarkarAug 15, 2024via ghsa
commit
2 files changed · +87 −0
  • loader/loader.go+31 −0 modified
    @@ -247,13 +247,18 @@ func (fl fileLoader) AsBundle(path string) (*bundle.Bundle, error) {
 		return nil, err
 	}
 
+	if err := checkForUNCPath(path); err != nil {
+		return nil, err
+	}
+
 	var bundleLoader bundle.DirectoryLoader
 	var isDir bool
 	if fl.reader != nil {
 		bundleLoader = bundle.NewTarballLoaderWithBaseURL(fl.reader, path).WithFilter(fl.filter)
 	} else {
 		bundleLoader, isDir, err = GetBundleDirectoryLoaderFS(fl.fsys, path, fl.filter)
 	}
+
 	if err != nil {
 		return nil, err
 	}
@@ -303,6 +308,10 @@ func GetBundleDirectoryLoaderFS(fsys fs.FS, path string, filter Filter) (bundle.
 		return nil, false, err
 	}
 
+	if err := checkForUNCPath(path); err != nil {
+		return nil, false, err
+	}
+
 	var fi fs.FileInfo
 	if fsys != nil {
 		fi, err = fs.Stat(fsys, path)
@@ -663,12 +672,18 @@ func allRec(fsys fs.FS, path string, filter Filter, errors *Errors, loaded *Resu
 		return
 	}
 
+	if err := checkForUNCPath(path); err != nil {
+		errors.add(err)
+		return
+	}
+
 	var info fs.FileInfo
 	if fsys != nil {
 		info, err = fs.Stat(fsys, path)
 	} else {
 		info, err = os.Stat(path)
 	}
+
 	if err != nil {
 		errors.add(err)
 		return
@@ -804,3 +819,19 @@ func makeDir(path []string, x interface{}) (map[string]interface{}, bool) {
 	}
 	return makeDir(path[:len(path)-1], map[string]interface{}{path[len(path)-1]: x})
 }
+
+// isUNC reports whether path is a UNC path.
+func isUNC(path string) bool {
+	return len(path) > 1 && isSlash(path[0]) && isSlash(path[1])
+}
+
+func isSlash(c uint8) bool {
+	return c == '\\' || c == '/'
+}
+
+func checkForUNCPath(path string) error {
+	if isUNC(path) {
+		return fmt.Errorf("UNC path read is not allowed: %s", path)
+	}
+	return nil
+}
  • loader/loader_test.go+56 −0 modified
    @@ -8,6 +8,7 @@ import (
 	"bytes"
 	"embed"
 	"encoding/json"
+	"fmt"
 	"io"
 	"io/fs"
 	"os"
@@ -574,6 +575,61 @@ func TestAsBundleWithFile(t *testing.T) {
 	})
 }
 
+func TestCheckForUNCPath(t *testing.T) {
+	cases := []struct {
+		input   string
+		wantErr bool
+		err     error
+	}{
+		{
+			input:   "c:/foo",
+			wantErr: false,
+		},
+		{
+			input:   "file:///c:/a/b",
+			wantErr: false,
+		},
+		{
+			input:   `\\localhost\c$`,
+			wantErr: true,
+			err:     fmt.Errorf("UNC path read is not allowed: \\\\localhost\\c$"),
+		},
+		{
+			input:   `\\\\localhost\c$`,
+			wantErr: true,
+			err:     fmt.Errorf("UNC path read is not allowed: \\\\\\\\localhost\\c$"),
+		},
+		{
+			input:   `//localhost/foo`,
+			wantErr: true,
+			err:     fmt.Errorf("UNC path read is not allowed: //localhost/foo"),
+		},
+		{
+			input:   `file:///a/b/c`,
+			wantErr: false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.input, func(t *testing.T) {
+			err := checkForUNCPath(tc.input)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatal("Expected error but got nil")
+				}
+
+				if tc.err != nil && tc.err.Error() != err.Error() {
+					t.Fatalf("Expected error message %v but got %v", tc.err.Error(), err.Error())
+				}
+			} else {
+				if err != nil {
+					t.Fatalf("Unexpected error %v", err)
+				}
+			}
+		})
+	}
+}
+
 func TestLoadRooted(t *testing.T) {
 	files := map[string]string{
 		"/foo.json":         "[1,2,3]",

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.