PT-2023-29858 · Fides · Fides

H0Wl · Published 2023-10-24 · Updated 2023-11-01 · CVE-2023-46125

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1

Description The Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructure, such as various settings, servers’ addresses and ports and database username. This information is useful for administrative users as well as attackers, thus it should not be revealed to low-privileged users. This issue allows Admin UI users with roles lower than the owner role, e.g., the viewer role, to retrieve the config information using the API.

Recommendations For Fides versions prior to 2.22.1, upgrade to version 2.22.1 or later to secure the system against this threat. As a temporary workaround, consider restricting access to the GET api/v1/config endpoint to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

CVE-2023-46125

GHSA-RJXG-RPG3-9R89

Affected Products

Fides

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46125.json · Exploit
• https://github.com/ethyca/fides/commit/c9f3a620a4b4c1916e0941cb5624dcd636f06d06 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-46125 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46125 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rjxg-rpg3-9r89 · Vendor Advisory
• https://github.com/ethyca/fides · Note
• https://github.com/ethyca/fides/releases/tag/2.22.1 · Note
• https://github.com/ethyca/fides/security/advisories/GHSA-rjxg-rpg3-9r89 · Note
• https://t.me/latest_high_impact_cve/48 · Telegram Post
• https://twitter.com/CVEnew/status/1716951092763009471 · Twitter Post