CVE-2023-41319
📋 TL;DR
This vulnerability allows authenticated, highly-privileged users to bypass the sandbox environment in Fides webserver API and execute arbitrary code with root privileges. It affects Fides versions 2.11.0 through 2.19.0 when the 'allow_custom_connector_functions' configuration is enabled. By default this configuration is disabled, limiting exposure.
💻 Affected Systems
- Fides
📦 What is this software?
Fides by Ethyca
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level code execution, allowing attackers to pivot to underlying infrastructure and integrated systems.
Likely Case
Privileged authenticated users could execute arbitrary code within the webserver container, potentially accessing sensitive privacy data and system resources.
If Mitigated
Limited to authenticated users with specific high privileges, and only if custom connector functions are explicitly enabled.
🎯 Exploit Status
Exploitation requires: 1) CONNECTOR_TEMPLATE_REGISTER authorization scope (root/owner users), 2) allow_custom_connector_functions enabled, 3) ability to upload ZIP files with custom Python code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.19.0
Vendor Advisory: https://github.com/ethyca/fides/security/advisories/GHSA-p6p2-qq95-vq5h
Restart Required: Yes
Instructions:
1. Backup your Fides configuration and data. 2. Update Fides to version 2.19.0 or later using your deployment method (Docker, Kubernetes, etc.). 3. Restart the Fides webserver container/service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable custom connector functions
allEnsure the vulnerable feature is disabled in configuration
sed -i "s/allow_custom_connector_functions = true/allow_custom_connector_functions = false/g" /path/to/fides.toml
export FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS=False
🧯 If You Can't Patch
- Ensure 'allow_custom_connector_functions' is set to false in fides.toml and FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS environment variable is unset or explicitly set to False
- Restrict CONNECTOR_TEMPLATE_REGISTER authorization scope to only absolutely necessary users and monitor their activity
🔍 How to Verify
Check if Vulnerable:
Check Fides version with 'fides --version' or inspect container image tag. If version is between 2.11.0 and 2.19.0, check fides.toml for 'allow_custom_connector_functions = true' or environment variable FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS=True.Check Version:
fides --versionVerify Fix Applied:
Confirm Fides version is 2.19.0 or later with 'fides --version'. Verify configuration does not have allow_custom_connector_functions enabled.📡 Detection & Monitoring
Log Indicators:
- Unusual ZIP file uploads to connector template API
- Execution of unexpected Python code in webserver logs
- Privilege escalation attempts from webserver process
Network Indicators:
- Unusual outbound connections from Fides webserver container
- Unexpected process spawning from webserver
SIEM Query:
source="fides-webserver" AND (event="connector_template_upload" OR event="custom_code_execution")🔗 References
- https://github.com/ethyca/fides/commit/5989b5fa744c8d8c340963b895a054883549358a
- https://github.com/ethyca/fides/security/advisories/GHSA-p6p2-qq95-vq5h
- https://github.com/ethyca/fides/commit/5989b5fa744c8d8c340963b895a054883549358a
- https://github.com/ethyca/fides/security/advisories/GHSA-p6p2-qq95-vq5h
