The vulnerability arises because the toCedarExpr() method on Cedar Value types does not escape special characters (" or \\) when converting values to Cedar source code. If an integrator uses this method to build policy text dynamically from user-controlled input, an attacker can inject arbitrary Cedar expressions. For example, injecting '|| true' into a permit clause can make the permit unconditional, or injecting '&& false' into a forbid clause can disable the forbid condition. This improper control of code generation (CWE-94) can lead to complete compromise of authorization decisions. The issue affects cedar-java versions prior to 2.3.6, versions from 3.0.0 up to but not including 3.4.1, and versions from 4.0.0 up to but not including 4.9.0. The vulnerability has been addressed in versions 2.3.6, 3.4.1, and 4.9.0.

Successful exploitation allows an attacker to inject arbitrary Cedar expressions into policy text, potentially resulting in unauthorized access by making permit clauses unconditional or disabling forbid clauses. This compromises the integrity and correctness of authorization decisions, leading to high confidentiality, integrity, and availability impacts as indicated by the CVSS score of 8.8.

A fix is available in cedar-java versions 2.3.6, 3.4.1, and 4.9.0. Users and integrators should upgrade to one of these versions or later to remediate this vulnerability. Additionally, integrators should avoid using toCedarExpr() to build policy text at runtime from user-controlled input or ensure proper escaping of special characters if dynamic policy generation is necessary.