ethyca-fides@2.15.1 vulnerabilities

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Timing Attack due to the discrepancy in response times between valid and invalid usernames in the login endpoint. An attacker can determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. By exploiting this vulnerability, an attacker can enumerate users on the system.

Upgrade ethyca-fides to version 2.44.0 or higher.

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Information Exposure Through an Error Message due to a flaw in the internal function handling sensitive annotations, which fails to mask nested sensitive fields properly. An attacker can access sensitive data such as private keys by exploiting this vulnerability in the API endpoint exposure. This is only exploitable if the BigQuery connection configuration secrets are used, as other connection types with non-nested sensitive fields are not affected.

Upgrade ethyca-fides to version 2.37.0 or higher.

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to improper escaping of the password string in the webserver configuration. An attacker can access part of the database password by examining error logs where this information is inadvertently logged.

Upgrade ethyca-fides to version 2.37.0 or higher.

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) when the subject_identity_verification_required function is enabled. An attacker can predict all future one-time code values during the lifetime of the backend python process by generating several hundred consecutive one-time codes. This allows the attacker to submit a verified data erasure request, resulting in deletion of data for the targeted user and submit a verified consent request, modifying a user's privacy preferences. This is only exploitable if subject_identity_verification_required in the [execution] section of fides.toml or the env var FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED is set to True on the fides webserver backend.

Upgrade ethyca-fides to version 2.24.0 or higher.

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the HTML-Formatted DSR Packages function. An attacker can inject HTML that can be abused for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the file:// protocol by exploiting the lack of validation of input coming from connected systems and data stores.

Mitigation: This vulnerability can be mitigated by using json or csv instead of html as the package format in the storage destination.

Upgrade ethyca-fides to version 2.23.3 or higher.

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the saas_util.py and authenticated_client.py files. An attacker can perform arbitrary requests to internal systems and exfiltrate data outside the environment by uploading specially crafted YAML dataset and config files.

Note: This is only exploitable if the API client has the CONNECTOR_TEMPLATE_REGISTER authorization scope, which is typically restricted to highly privileged users such as root users and users with the owner role.

Upgrade ethyca-fides to version 2.22.1 or higher.

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data via the api/v1/config endpoint. An attacker can retrieve sensitive configuration information, by exploiting the API.

Note: This is only exploitable if the user has roles lower than the owner role, such as the viewer role.

Upgrade ethyca-fides to version 2.22.1 or higher.

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in src/fides/api/schemas/privacy_experience.py. An attacker can trigger JavaScript execution on an integrated website by crafting a payload in the privacy policy URL.

Note:

This exploitation is limited to Admin UI users with the contributor role or higher.

Upgrade ethyca-fides to version 2.22.1 or higher.

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) in the fides.toml file and the FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS variable.

Note: Exploitation is only possible if the security configuration parameter allow_custom_connector_functions is enabled by the user deploying the Fides webserver container, either in fides.toml or by setting the env var FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS=True. By default this configuration parameter is disabled.

Upgrade ethyca-fides to version 2.19.0 or higher.

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Arbitrary Code Execution when the Fides webserver API is used to upload a ZIP file containing custom Python code. An attacker can execute arbitrary code on the target system within the context of the webserver python process owner on the webserver container, which by default is root, and leverage that access to attack underlying infrastructure and integrated systems by bypassing the sandboxed environment.

Note: This is only exploitable if the security configuration parameter allow_custom_connector_functions is enabled by the user deploying the Fides webserver container, either in fides.toml or by setting the env var FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS=True.

Upgrade ethyca-fides to version 2.19.0 or higher.

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to the save_template() function in connector_registry_service.py accepting uploads of files that could contain a zip bomb. Users with elevated privileges with the CONNECTOR_TEMPLATE_REGISTER scope can exploit this to deny access to all users of the affected server.

Upgrade ethyca-fides to version 2.16.0 or higher.