GHSA-v7vm-rhmg-8j2r CVE-2024-52008 PYSEC-2026-1349
Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.56%
- Chance of exploitation in the next 30 days. Higher than 46.44% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-602 Client-Side Enforcement of Server-Side Security
- Fix
2.50.0- Upgrade ethyca-fides to this version or later
Description
Summary
The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these checks, enabling the creation of accounts with passwords as short as a single character.
Details
When an email messaging provider is enabled and a new user account is created in the system, an invite email containing a special link is sent to the new user's email address. This link directs the new user to a page where they can set their initial password. While the user interface implements password complexity checks, these validations are only performed client-side. The underlying /api/v1/user/accept-invite API endpoint does not implement the same password policy validations.
Impact
This vulnerability allows an invited user to set an extremely weak password for their own account during the initial account setup process. Therefore that specific user's account can be compromised easily by an attacker guessing or brute forcing the password.
Patches
The vulnerability has been patched in Fides version 2.50.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds
There are no workarounds.
Severity
This vulnerability has been assigned a severity of LOW.
Using CVSS v3.1 it could be scored as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N (5.7 Medium/Moderate), but the likelihood of a user bypassing client-side password complexity rules to set their own password is very low.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| ethyca-fides | < 2.50.0 |
2.50.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ethyca-fides PyPI → 2.50.0
- pip
pip install --upgrade "ethyca-fides>=2.50.0"- poetry
poetry add "ethyca-fides>=2.50.0"- uv
uv add "ethyca-fides>=2.50.0"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- Active
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Unreported
CVSS 3.1 5.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-602: Client-Side Enforcement of Server-Side Security
The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
How to prevent it
- Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server. Even though client-side checks provide minimal benefits with respect to server-side security, they are still useful. First, they can support intrusion detection. If the server receives input that should have been rejected by the client, then it may be an indication of an attack. Second, client-side error-checking can provide helpful feedback to the user about the expectations for valid input. Third, there may be a reduction in server-side processing time for accidental input errors, although this is typically a small savings.
- Architecture and Design: If some degree of trust is required between the two entities, then use integrity checking and strong authentication to ensure that the inputs are coming from a trusted source. Design the product so that this trust is managed in a centralized fashion, especially if there are complex or numerous communication channels, in order to reduce the risks that the implementer will mistakenly omit a check in a single code path.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5qrq-9645-g5g2 ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override | High | Also affects ethyca-fides |
| GHSA-qx5f-ghc2-7g5c Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection | Medium | Also affects ethyca-fides |
| GHSA-hjfh-p8f5-24wr Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation | High | Also affects ethyca-fides |
| GHSA-fq34-xw6c-fphf Fides Webserver API Rate Limiting Vulnerability in Proxied Environments | High | Also affects ethyca-fides |
| GHSA-7q62-r88r-j5gw Fides has a Lack of Brute-Force Protections on Authentication Endpoints | Medium | Also affects ethyca-fides |
| GHSA-rpw8-82v9-3q87 Fides' Admin UI User Password Change Does Not Invalidate Current Session | Medium | Also affects ethyca-fides |
| GHSA-c34r-238x-f7qx Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine | High | Also affects ethyca-fides |
| GHSA-2h46-8gf5-fmxv Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication | Medium | Also affects ethyca-fides |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor