ethyca-fides 2.33.2a0 vulnerabilities

Known vulnerabilities in the ethyca-fides package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
M Client-Side Enforcement of Server-Side Security ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Client-Side Enforcement of Server-Side Security due to improper implementation of password policy validations in the `/api/v1/user/accept-invite` endpoint. An attacker can compromise a user's account by setting an extremely weak password during the initial account setup process by bypassing client-side password complexity checks. How to fix Client-Side Enforcement of Server-Side Security? Upgrade `ethyca-fides` to version 2.50.0rc0 or higher.	[,2.50.0rc0)
M Improper Control of Generation of Code ('Code Injection') ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') due to improper input sanitization and lack of rendering environment restrictions in the Email Templating feature. An attacker can execute arbitrary code on the server by injecting malicious templates. Note: This is only exploitable if the attacker has `Owner` or `Contributor` role access. OAuth clients with the `messaging-template:update` scope are also authorized to use the PUT `/api/v1/messaging/templates/` Fides Webserver API endpoint and may also exploit this vulnerability. How to fix Improper Control of Generation of Code ('Code Injection')? Upgrade `ethyca-fides` to version 2.44.0 or higher.	[2.19.0,2.44.0)
M Timing Attack ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Timing Attack due to the discrepancy in response times between valid and invalid usernames in the login endpoint. An attacker can determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. By exploiting this vulnerability, an attacker can enumerate users on the system. How to fix Timing Attack? Upgrade `ethyca-fides` to version 2.44.0 or higher.	[,2.44.0)
M Exposure of Sensitive Information to an Unauthorized Actor ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor through the `SERVER_SIDE_FIDES_API_URL` environment variable. An attacker can obtain sensitive server-side configuration details by making an unauthorized HTTP GET request. How to fix Exposure of Sensitive Information to an Unauthorized Actor? Upgrade `ethyca-fides` to version 2.39.2 or higher.	[2.19.0,2.39.2)
M Information Exposure Through an Error Message ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Information Exposure Through an Error Message due to a flaw in the internal function handling `sensitive` annotations, which fails to mask nested sensitive fields properly. An attacker can access sensitive data such as private keys by exploiting this vulnerability in the API endpoint exposure. This is only exploitable if the `BigQuery` connection configuration secrets are used, as other connection types with non-nested sensitive fields are not affected. How to fix Information Exposure Through an Error Message? Upgrade `ethyca-fides` to version 2.37.0 or higher.	[,2.37.0)
L Insertion of Sensitive Information into Log File ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to improper escaping of the password string in the webserver configuration. An attacker can access part of the database password by examining error logs where this information is inadvertently logged. How to fix Insertion of Sensitive Information into Log File? Upgrade `ethyca-fides` to version 2.37.0 or higher.	[,2.37.0)

Vulnerability

Vulnerable Version

Client-Side Enforcement of Server-Side Security

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Client-Side Enforcement of Server-Side Security due to improper implementation of password policy validations in the /api/v1/user/accept-invite endpoint. An attacker can compromise a user's account by setting an extremely weak password during the initial account setup process by bypassing client-side password complexity checks.

How to fix Client-Side Enforcement of Server-Side Security?

Upgrade ethyca-fides to version 2.50.0rc0 or higher.

[,2.50.0rc0)

Improper Control of Generation of Code ('Code Injection')

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') due to improper input sanitization and lack of rendering environment restrictions in the Email Templating feature. An attacker can execute arbitrary code on the server by injecting malicious templates.

Note:

This is only exploitable if the attacker has Owner or Contributor role access.

OAuth clients with the messaging-template:update scope are also authorized to use the PUT /api/v1/messaging/templates/ Fides Webserver API endpoint and may also exploit this vulnerability.

How to fix Improper Control of Generation of Code ('Code Injection')?

Upgrade ethyca-fides to version 2.44.0 or higher.

[2.19.0,2.44.0)

Timing Attack

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Timing Attack due to the discrepancy in response times between valid and invalid usernames in the login endpoint. An attacker can determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. By exploiting this vulnerability, an attacker can enumerate users on the system.

How to fix Timing Attack?

Upgrade ethyca-fides to version 2.44.0 or higher.

[,2.44.0)

Exposure of Sensitive Information to an Unauthorized Actor

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor through the SERVER_SIDE_FIDES_API_URL environment variable. An attacker can obtain sensitive server-side configuration details by making an unauthorized HTTP GET request.

How to fix Exposure of Sensitive Information to an Unauthorized Actor?

Upgrade ethyca-fides to version 2.39.2 or higher.

[2.19.0,2.39.2)

Information Exposure Through an Error Message

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Information Exposure Through an Error Message due to a flaw in the internal function handling sensitive annotations, which fails to mask nested sensitive fields properly. An attacker can access sensitive data such as private keys by exploiting this vulnerability in the API endpoint exposure. This is only exploitable if the BigQuery connection configuration secrets are used, as other connection types with non-nested sensitive fields are not affected.

How to fix Information Exposure Through an Error Message?

Upgrade ethyca-fides to version 2.37.0 or higher.

[,2.37.0)

Insertion of Sensitive Information into Log File

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to improper escaping of the password string in the webserver configuration. An attacker can access part of the database password by examining error logs where this information is inadvertently logged.

How to fix Insertion of Sensitive Information into Log File?

Upgrade ethyca-fides to version 2.37.0 or higher.

[,2.37.0)

ethyca-fides@2.33.2a0 vulnerabilities

Open-source ecosystem for data privacy as code.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?