Fides Privacy Center ≤ 2.39.1 - Server-Side URL Disclosure

mediumseverity

5.3CVSS score

1.1%likelihood of exploitation, next 30 days

66%of all CVEs are less likely

Readycheck to confirm it

Fides versions 2.19.0 to before 2.39.2rc0 contain an information disclosure caused by unauthenticated HTTP GET request to the Privacy Center, letting attackers access the SERVER_SIDE_FIDES_API_URL, which may reveal server configuration details, exploit requires no authentication.

Impact

Attackers can obtain server-side URLs, revealing private IPs, ports, and domain names, potentially aiding further targeted attacks.

Fix

Update to version 2.39.2rc0 or later.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains "SERVER_SIDE_FIDES_API_URL" AND status 200

Run it with nuclei: nuclei -id CVE-2024-31223 -u <target>

The full check

id: CVE-2024-31223

info:
  name: Fides Privacy Center ≤ 2.39.1 - Server-Side URL Disclosure
  author: hnd3884
  severity: medium
  description: |
    Fides versions 2.19.0 to before 2.39.2rc0 contain an information disclosure caused by unauthenticated HTTP GET request to the Privacy Center, letting attackers access the SERVER_SIDE_FIDES_API_URL, which may reveal server configuration details, exploit requires no authentication.
  impact: |
    Attackers can obtain server-side URLs, revealing private IPs, ports, and domain names, potentially aiding further targeted attacks.
  remediation: |
    Update to version 2.39.2rc0 or later.
  reference:
    - https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097
    - https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg
    - https://nvd.nist.gov/vuln/detail/CVE-2024-31223
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-31223
    cwe-id: CWE-497
    epss-score: 0.01105
    epss-percentile: 0.66053
    cpe: cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"SERVER_SIDE_FIDES_API_URL"
  tags: cve,cve2024,vuln,ethyca,fides,disclosure,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "SERVER_SIDE_FIDES_API_URL"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: server_side_fides_api_url
        group: 1
        regex:
          - '"SERVER_SIDE_FIDES_API_URL":"(.+?)"'

References

Use this check only on systems you are authorised to test. Where the data comes from