PT-2023-25991 · Fides · Fides

Daveqnet · Publicado 2023-07-18 · Atualizado 2023-07-27 · CVE-2023-37481

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Fides versions 2.11.0 through 2.15.1

Description The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs, causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (datastore-connection/new). Exploitation is limited to users with elevated privileges with the CONNECTOR TEMPLATE REGISTER scope, which includes root users and users with the owner role.

Recommendations For Fides versions 2.11.0 through 2.15.1, upgrade to version 2.16.0 or later to secure the system against this threat. As a temporary workaround, consider restricting access to the datastore-connection/new page until a patch is available. Avoid using the CONNECTOR TEMPLATE REGISTER scope for users without elevated privileges until the issue is resolved. Restrict the upload of zip files to minimize the risk of exploitation.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2023-37481

GHSA-3RW2-WFC8-WMJ5

Produtos afetados

Fides

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37481.json · Exploit
• https://github.com/ethyca/fides · Nota
• https://github.com/ethyca/fides/commit/8beaace082b325e693dc7682029a3cb7e6c2b69d · Correção
• https://github.com/ethyca/fides/security/advisories/GHSA-3rw2-wfc8-wmj5 · Aviso do Fabricante
• https://github.com/ethyca/fides/releases/tag/2.16.0 · Nota
• https://t.me/cibsecurity/66947 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-37481 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-3rw2-wfc8-wmj5 · Aviso do Fabricante
• https://t.me/cvenotify/55360 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-37481 · Aviso do Fabricante