PT-2023-29857 · Fides · Fides

Grmpyninja · Published 2023-10-24 · Updated 2023-11-01 · CVE-2023-46124

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1

Description The Fides web application is vulnerable to a Server-Side Request Forgery (SSRF) attack. This occurs when a malicious user uploads a specially crafted YAML dataset and config file as a ZIP file, allowing them to perform arbitrary requests to internal systems and exfiltrate data outside the environment. The application fails to properly validate attempts to connect to internal resources, including localhost. Exploitation of this issue is limited to API clients with the CONNECTOR TEMPLATE REGISTER authorization scope, which is typically restricted to highly privileged users, such as root users and users with the owner role.

Recommendations For versions prior to 2.22.1, upgrade to version 2.22.1 or later to secure your system against this threat. As a temporary workaround, consider restricting access to the CONNECTOR TEMPLATE REGISTER authorization scope to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-46124

GHSA-JQ3W-9MGF-43M4

Affected Products

Fides

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46124.json · Exploit
• https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1ee · Patch
• https://osv.dev/vulnerability/CVE-2023-46124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46124 · Security Note
• https://osv.dev/vulnerability/GHSA-jq3w-9mgf-43m4 · Vendor Advisory
• https://github.com/ethyca/fides · Note
• https://github.com/ethyca/fides/releases/tag/2.22.1 · Note
• https://github.com/ethyca/fides/security/advisories/GHSA-jq3w-9mgf-43m4 · Note
• https://t.me/latest_high_impact_cve/48 · Telegram Post
• https://twitter.com/CVEnew/status/1716956540161470856 · Twitter Post