CVE-2023-36827
📋 TL;DR
CVE-2023-36827 is a path traversal vulnerability in Fides privacy engineering platform that allows remote attackers to read arbitrary files on the webserver container's filesystem. This affects Fides versions below 2.15.1. Organizations using vulnerable Fides deployments with direct internet access to the API are at risk.
💻 Affected Systems
- Fides
📦 What is this software?
Fides by Ethyca
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive configuration files, secrets, and system files, potentially leading to full system compromise and data privacy regulation violations.
Likely Case
Unauthorized access to configuration files containing database credentials, API keys, or other sensitive operational data.
If Mitigated
If deployed behind AWS ALB as recommended, the attack is blocked with 400 errors. Secrets stored as environment variables remain protected.
🎯 Exploit Status
Path traversal vulnerabilities typically have low exploitation complexity. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.15.1
Vendor Advisory: https://github.com/ethyca/fides/security/advisories/GHSA-r25m-cr6v-p9hq
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Update Fides to version 2.15.1 or higher using package manager or container update. 3. Restart Fides services. 4. Verify functionality.
🔧 Temporary Workarounds
Deploy behind AWS Application Load Balancer
allConfigure AWS ALB as reverse proxy to block path traversal attempts
Use environment variables for secrets
allStore sensitive configuration in environment variables instead of fides.toml files
🧯 If You Can't Patch
- Deploy Fides behind AWS Application Load Balancer or similar WAF that blocks path traversal patterns
- Restrict network access to Fides API endpoints using firewall rules or network segmentation
🔍 How to Verify
Check if Vulnerable:
Check Fides version: if below 2.15.1 and API is directly accessible, system is vulnerableCheck Version:
Check container image tag or run: fides --version (if CLI available)Verify Fix Applied:
Confirm Fides version is 2.15.1 or higher and test API endpoints for path traversal attempts📡 Detection & Monitoring
Log Indicators:
- HTTP 400 errors from AWS ALB
- Unusual file access patterns in webserver logs
- Requests containing '../' patterns
Network Indicators:
- HTTP requests with path traversal sequences to Fides API endpoints
SIEM Query:
source="fides" AND (uri="*../*" OR status=400)🔗 References
- https://github.com/ethyca/fides/commit/f526d9ffb176006d701493c9d0eff6b4884e811f
- https://github.com/ethyca/fides/releases/tag/2.15.1
- https://github.com/ethyca/fides/security/advisories/GHSA-r25m-cr6v-p9hq
- https://github.com/ethyca/fides/commit/f526d9ffb176006d701493c9d0eff6b4884e811f
- https://github.com/ethyca/fides/releases/tag/2.15.1
- https://github.com/ethyca/fides/security/advisories/GHSA-r25m-cr6v-p9hq
