CVE-2024-8260

What it actually does

The vulnerability allows an attacker to supply an arbitrary SMB share path in place of a legitimate Rego policy file to the OPA CLI or Go library functions on Windows, triggering forced authentication to the attacker's SMB server due to improper input validation.

Why it matters to the business

Organizations using OPA on Windows face risk of credential theft via forced SMB authentication, potentially enabling lateral movement or unauthorized access, with 15,768 downstream dependents amplifying exposure across ecosystems.

How an attack unfolds

An attacker provides a malicious SMB share URI as input to OPA CLI or library functions; OPA attempts to access the path, forcing the Windows client to authenticate to the attacker-controlled server and exposing NTLM hashes or credentials.

How to fix it

Upgrade all OPA for Windows installations to version 0.68.0 or later. Apply the listed fixed versions for any affected Jackson Databind packages by updating to 2.9.10.8.

How to confirm the fix worked

Confirm OPA version is 0.68.0 or higher; test by attempting to pass an SMB share path and verifying rejection with an error rather than attempted access.

Typical attack path

1. Identify Windows systems running OPA CLI or applications using the OPA Go library
2. Craft input containing an attacker-controlled SMB share path instead of a Rego file
3. Invoke OPA with the malicious path argument
4. Capture forced authentication attempts and extract credentials on the attacker SMB server

How to detect it

Review Windows security and SMB event logs for authentication attempts initiated by OPA processes to unexpected external shares; inspect command-line arguments passed to OPA for SMB or UNC paths.

• opa.exe command line containing \\ or smb://
• SMB NTLM authentication events from OPA process to non-internal servers

What your security team should do

• Prioritize upgrade of OPA on Windows to v0.68.0 within the next patching cycle given ecosystem prevalence
• Audit all OPA CLI invocations and library calls for unsanitized file path inputs
• Enable enhanced SMB authentication logging on Windows hosts running OPA