CVE-2023-37481: Fides Webserver Vulnerable to SVG Bomb File Uploads
Impact The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (datastore-connection/new).
This vulnerability affects Fides versions 2.11.0 through 2.15.1. Exploitation is limited to users with elevated privileges with the CONNECTORTEMPLATEREGISTER scope, which includes root users and users with the owner role.
Patches The vulnerability has been patched in Fides version 2.16.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds There is no known workaround to remediate this vulnerability without upgrading.
Other sources
Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (datastore-connection/new). This vulnerability affects Fides versions 2.11.0 through 2.15.1. Exploitation is limited to users with elevated privileges with the CONNECTORTEMPLATEREGISTER scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version 2.16.0. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/ethyca-fidesto a version that resolves this vulnerability.Fixed in 2.16.0 - Upgrade
Upgrade
Fides webserverto a version that resolves this vulnerability.Fixed in 2.16.0
Event History
Frequently Asked Questions
What is the impact of CVE-2023-37481?
The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack, allowing attackers to upload malicious SVG bomb zip files.
Which software versions are affected by CVE-2023-37481?
The Fides software versions between 2.11.0 and 2.16.0 are affected by the CVE-2023-37481 vulnerability.
How severe is CVE-2023-37481?
CVE-2023-37481 has a severity level of 4.9 (medium).
How can I fix CVE-2023-37481?
To fix CVE-2023-37481, update your Fides software to version 2.16.0 or later.
What is the Common Weakness Enumeration (CWE) ID of CVE-2023-37481?
The Common Weakness Enumeration (CWE) ID of CVE-2023-37481 is 400.