CVE-2023-46124: Server-Side Request Forgery Vulnerability in Custom Integration Upload
Impact
The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format.
It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources.
Exploitation is limited to API clients with the CONNECTORTEMPLATEREGISTER authorization scope. In the Fides Admin UI this scope is restricted to highly privileged users, specifically root users and users with the owner role.
Patches The vulnerability has been patched in Fides version 2.22.1. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds There are no workarounds.
Other sources
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version 2.22.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the impact of CVE-2023-46124?
The vulnerability allows a malicious user to perform arbitrary requests to internal systems.
How does CVE-2023-46124 affect the Fides web application?
The vulnerability affects the Fides web application by allowing a custom integration upload that can be exploited by a malicious user.
What is the software affected by CVE-2023-46124?
The affected software is the ethyca-fides package with version 2.22.1 installed via pip.
How can I fix CVE-2023-46124 on my system?
To fix the vulnerability, update the ethyca-fides package to version 2.22.1 or higher using pip.
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-46124?
The CWE ID for CVE-2023-46124 is 918.