Remote Code Execution

ethyca-fides is vulnerable to Arbitrary Code Execution. The vulnerability is due to certain API clients who have a special level of permission called “CONNECTOR_TEMPLATE_REGISTER.” In the Fides Admin interface one can upload a zip file with arbitrary python code and can execute it. Exploitation is only possible if the user enabling a security configuration parameter called “allow_custom_connector_functions”.