CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46124 – Server-Side Request Forgery Vulnerability in Custom Integration Upload
https://notcve.org/view.php?id=CVE-2023-46124
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version `2.22.1`. • https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1ee https://github.com/ethyca/fides/releases/tag/2.22.1 https://github.com/ethyca/fides/security/advisories/GHSA-jq3w-9mgf-43m4 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46125 – Fides Information Disclosure Vulnerability in Config API Endpoint
https://notcve.org/view.php?id=CVE-2023-46125
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the `GET api/v1/config` endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructure, such as various settings, servers’ addresses and ports and database username. This information is useful for administrative users as well as attackers, thus it should not be revealed to low-privileged users. This vulnerability allows Admin UI users with roles lower than the owner role e.g. the viewer role to retrieve the config information using the API. • https://github.com/ethyca/fides/commit/c9f3a620a4b4c1916e0941cb5624dcd636f06d06 https://github.com/ethyca/fides/releases/tag/2.22.1 https://github.com/ethyca/fides/security/advisories/GHSA-rjxg-rpg3-9r89 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46126 – Fides JavaScript Injection Vulnerability in Privacy Center URL
https://notcve.org/view.php?id=CVE-2023-46126
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher. • https://github.com/ethyca/fides/commit/3231d19699f9c895c986f6a967a64d882769c506 https://github.com/ethyca/fides/releases/tag/2.22.1 https://github.com/ethyca/fides/security/advisories/GHSA-fgjj-5jmr-gh83 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41319 – Remote Code Execution in Custom Integration Upload in Fides
https://notcve.org/view.php?id=CVE-2023-41319
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides can be configured to also accept the inclusion of custom Python code in it. The custom code is executed in a restricted, sandboxed environment, but the sandbox can be bypassed to execute any arbitrary code. The vulnerability allows the execution of arbitrary code on the target system within the context of the webserver python process owner on the webserver container, which by default is `root`, and leverage that access to attack underlying infrastructure and integrated systems. • https://github.com/ethyca/fides/commit/5989b5fa744c8d8c340963b895a054883549358a https://github.com/ethyca/fides/security/advisories/GHSA-p6p2-qq95-vq5h • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-693: Protection Mechanism Failure •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37480 – Fides Webserver Vulnerable to Zip Bomb File Uploads
https://notcve.org/view.php?id=CVE-2023-37480
Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver. This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. • https://github.com/ethyca/fides/commit/5aea738463960d81821c11ae7ade1d627a46bf32 https://github.com/ethyca/fides/security/advisories/GHSA-g95c-2jgm-hqc6 • CWE-400: Uncontrolled Resource Consumption •