CVE-2024-31223
published 2024-07-03CVE-2024-31223: Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides…
PriorityP180medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.11%
61.9th percentile
Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ethyca | fides | — | — |
| ethyca | fides | >= 2.19.0 < 2.39.2 | 2.39.2 |
Detection & IOCsextracted from sources · hover to see the quote
yara↗
regex: '"SERVER_SIDE_FIDES_API_URL":"(.+?)"'
- →Send an unauthenticated HTTP GET request to the root path of the Fides Privacy Center. A vulnerable instance will return HTTP 200 with the string 'SERVER_SIDE_FIDES_API_URL' in the response body, disclosing the server-side API URL. ↗
- →Use the Shodan dork `html:"SERVER_SIDE_FIDES_API_URL"` to identify internet-exposed Fides Privacy Center instances potentially vulnerable to this information disclosure. ↗
- →Extract the disclosed server-side URL from the response body using the regex pattern `"SERVER_SIDE_FIDES_API_URL":"(.+?)"` — the captured group contains the private IP/domain/port configuration. ↗
- →No authentication is required to trigger the disclosure; any HTTP GET to the Privacy Center root is sufficient. Monitor web server access logs for unauthenticated GET requests to '/' that return 200 on Fides Privacy Center instances. ↗
- ·The vulnerability only affects Fides Privacy Center deployments running versions 2.19.0 up to (but not including) 2.39.2rc0. Instances outside this version range are not affected. ↗
- ·The disclosed value is the `SERVER_SIDE_FIDES_API_URL` environment variable, which may contain private IP addresses, private domain names, and/or non-standard ports — all of which are server-side configuration details not intended for public exposure. ↗
- ·No known workarounds exist; the only remediation is upgrading to Fides version 2.39.2rc0 or later. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vulncheck5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
ghsa·2024-07-05
CVE-2024-31223 [MEDIUM] CWE-497 Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
`SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port.
This vulnerability allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL.
### Impact
Disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names.
### Patches
The vulnerability has been patched in Fides version `2.39.2`. Users are advised to upgrade to this version or
OSV
Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
osv·2024-07-05
CVE-2024-31223 [MEDIUM] Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
`SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port.
This vulnerability allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL.
### Impact
Disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names.
### Patches
The vulnerability has been patched in Fides version `2.39.2`. Users are advised to upgrade to this version or
VulnCheck
ethyca fides Exposure of Sensitive System Information to an Unauthorized Control Sphere
vulncheck·2024·CVSS 5.3
CVE-2024-31223 [MEDIUM] ethyca fides Exposure of Sensitive System Information to an Unauthorized Control Sphere
ethyca fides Exposure of Sensitive System Information to an Unauthorized Control Sphere
Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domai
No detection rules found.
Nuclei
Fides Privacy Center ≤ 2.39.1 - Server-Side URL Disclosure
nuclei·CVSS 5.3
CVE-2024-31223 [MEDIUM] Fides Privacy Center ≤ 2.39.1 - Server-Side URL Disclosure
Fides Privacy Center ≤ 2.39.1 - Server-Side URL Disclosure
Fides versions 2.19.0 to before 2.39.2rc0 contain an information disclosure caused by unauthenticated HTTP GET request to the Privacy Center, letting attackers access the SERVER_SIDE_FIDES_API_URL, which may reveal server configuration details, exploit requires no authentication.
Template:
id: CVE-2024-31223
info:
name: Fides Privacy Center ≤ 2.39.1 - Server-Side URL Disclosure
author: hnd3884
severity: medium
description: |
Fides versions 2.19.0 to before 2.39.2rc0 contain an information disclosure caused by unauthenticated HTTP GET request to the Privacy Center, letting attackers access the SERVER_SIDE_FIDES_API_URL, which may reveal server configuration details, exploit requires no authentication.
impact: |
Attackers can obt
No writeups or analysis indexed.
https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qghttps://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg
2024-07-03
Published
Exploited in the wild