CVE-2024-31223
Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
In short
A vulnerability in Fides Privacy Center allows attackers to discover the private server URL configuration through an unauthenticated HTTP request, exposing sensitive information like internal IP addresses and ports.
Technical detail
An information disclosure vulnerability (CWE-497) in Fides versions 2.19.0 through 2.39.1 permits unauthenticated attackers to retrieve the SERVER_SIDE_FIDES_API_URL environment variable value via HTTP GET requests to the Privacy Center, disclosing backend infrastructure details including private IPs, domain names, and ports. Fixed in version 2.39.2rc0.
Summary generated and translated by AI from the official description.
Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
ethyca · fidesWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →