PT-2024-31404 · Fides · Fides

Robertkeyser · Published 2024-09-04 · Updated 2024-09-06 · CVE-2024-45052

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.44.0

Description A timing-based username enumeration vulnerability exists in Fides Webserver authentication, allowing an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy in response times between valid and invalid usernames can be leveraged to enumerate users on the system. This information can be used to conduct further attacks on authentication, such as password brute-forcing and credential stuffing.

Recommendations To resolve the issue, upgrade to Fides version 2.44.0 or later. There are no workarounds for this vulnerability. As a temporary mitigation measure, consider restricting access to the authentication endpoint until a patch is applied.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

CVE-2024-45052

GHSA-2H46-8GF5-FMXV

Affected Products

Fides

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45052.json · Exploit
• 🔥 https://github.com/ethyca/fides/security/advisories/GHSA-2h46-8gf5-fmxv · Exploit
• https://github.com/ethyca/fides/commit/457b0e9df9f0d337133d6078bca6ed88bbc745f4 · Patch
• https://osv.dev/vulnerability/GHSA-2h46-8gf5-fmxv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45052 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45052 · Vendor Advisory
• https://github.com/ethyca/fides · Note
• https://t.me/cvedetector/4809 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1831405865326281127 · Twitter Post
• https://twitter.com/CVEnew/status/1831359476521156793 · Twitter Post
• https://t.me/cvenotify/93308 · Telegram Post