GHSA-3rw2-wfc8-wmj5 CVE-2023-37481 PYSEC-2026-1332
Fides Webserver Vulnerable to SVG Bomb File Uploads
- Severity
- 2.7 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- 0.70%
- Chance of exploitation in the next 30 days. Higher than 53.34% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-400 Uncontrolled Resource Consumption
- Fix
2.16.0- Upgrade ethyca-fides to this version or later
Description
Impact
The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (datastore-connection/new).
This vulnerability affects Fides versions 2.11.0 through 2.15.1. Exploitation is limited to users with elevated privileges with the CONNECTOR_TEMPLATE_REGISTER scope, which includes root users and users with the owner role.
Patches
The vulnerability has been patched in Fides version 2.16.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds
There is no known workaround to remediate this vulnerability without upgrading.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| ethyca-fides | >= 2.11.0, < 2.16.0 |
2.16.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ethyca-fides PyPI → 2.16.0
- pip
pip install --upgrade "ethyca-fides>=2.16.0"- poetry
poetry add "ethyca-fides>=2.16.0"- uv
uv add "ethyca-fides>=2.16.0"
Severity breakdown
CVSS 3.1 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Weakness
CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
How to prevent it
- Architecture and Design: Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
- Architecture and Design: Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
- Implementation: Ensure that all failures in resource allocation place the system into a safe posture.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5qrq-9645-g5g2 ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override | High | Also affects ethyca-fides |
| GHSA-qx5f-ghc2-7g5c Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection | Medium | Also affects ethyca-fides |
| GHSA-hjfh-p8f5-24wr Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation | High | Also affects ethyca-fides |
| GHSA-fq34-xw6c-fphf Fides Webserver API Rate Limiting Vulnerability in Proxied Environments | High | Also affects ethyca-fides |
| GHSA-7q62-r88r-j5gw Fides has a Lack of Brute-Force Protections on Authentication Endpoints | Medium | Also affects ethyca-fides |
| GHSA-rpw8-82v9-3q87 Fides' Admin UI User Password Change Does Not Invalidate Current Session | Medium | Also affects ethyca-fides |
| GHSA-v7vm-rhmg-8j2r Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API | High | Also affects ethyca-fides |
| GHSA-c34r-238x-f7qx Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine | High | Also affects ethyca-fides |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor