CVE-2023-46124 Server-Side Request Forgery Vulnerability in Custom Integration Upload

2023-10-2422:51:55

CWE-918

GitHub_M

www.cve.org

cve-2023-46124

fides

privacy regulations

zip file

yaml format

arbitrary requests

internal systems

data exfiltration

validation

patched

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L

AI Score

8.4

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version 2.22.1.

CNA Affected

[
  {
    "vendor": "ethyca",
    "product": "fides",
    "versions": [
      {
        "version": "< 2.22.1",
        "status": "affected"
      }
    ]
  }
]