GHSA-jq3w-9mgf-43m4 CVE-2023-46124 PYSEC-2026-1344
Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload
- Severity
- 8.2 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.84%
- Chance of exploitation in the next 30 days. Higher than 57.84% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
2.22.1- Upgrade ethyca-fides to this version or later
Description
Impact
The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format.
It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources.
Exploitation is limited to API clients with the CONNECTOR_TEMPLATE_REGISTER authorization scope. In the Fides Admin UI this scope is restricted to highly privileged users, specifically root users and users with the owner role.
Patches
The vulnerability has been patched in Fides version 2.22.1. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds
There are no workarounds.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| ethyca-fides | < 2.22.1 |
2.22.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ethyca-fides PyPI → 2.22.1
- pip
pip install --upgrade "ethyca-fides>=2.22.1"- poetry
poetry add "ethyca-fides>=2.22.1"- uv
uv add "ethyca-fides>=2.22.1"
Severity breakdown
CVSS 3.1 8.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5qrq-9645-g5g2 ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override | High | Also affects ethyca-fides |
| GHSA-qx5f-ghc2-7g5c Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection | Medium | Also affects ethyca-fides |
| GHSA-hjfh-p8f5-24wr Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation | High | Also affects ethyca-fides |
| GHSA-fq34-xw6c-fphf Fides Webserver API Rate Limiting Vulnerability in Proxied Environments | High | Also affects ethyca-fides |
| GHSA-7q62-r88r-j5gw Fides has a Lack of Brute-Force Protections on Authentication Endpoints | Medium | Also affects ethyca-fides |
| GHSA-rpw8-82v9-3q87 Fides' Admin UI User Password Change Does Not Invalidate Current Session | Medium | Also affects ethyca-fides |
| GHSA-v7vm-rhmg-8j2r Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API | High | Also affects ethyca-fides |
| GHSA-c34r-238x-f7qx Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine | High | Also affects ethyca-fides |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor