CVE-2023-48224
📋 TL;DR
This vulnerability in the Fides privacy platform allows attackers to predict one-time verification codes due to weak random number generation. Attackers can submit verified data erasure requests to delete user data or modify privacy preferences. Only Fides instances with subject identity verification enabled are affected.
💻 Affected Systems
- Fides
📦 What is this software?
Fides by Ethyca
⚠️ Risk & Real-World Impact
Worst Case
Mass deletion of user data and unauthorized modification of privacy preferences for all users in the system
Likely Case
Targeted deletion of specific user data and privacy preference manipulation
If Mitigated
No impact if subject identity verification is disabled or proper patching is applied
🎯 Exploit Status
Exploitation requires generating several hundred consecutive one-time codes to predict future values, which is straightforward for attackers
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.24.0
Vendor Advisory: https://github.com/ethyca/fides/security/advisories/GHSA-82vr-5769-6358
Restart Required: Yes
Instructions:
1. Backup your Fides configuration and data. 2. Stop the Fides service. 3. Upgrade to Fides version 2.24.0 or later using your package manager or deployment method. 4. Restart the Fides service. 5. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable subject identity verification
allTemporarily disable the vulnerable feature by setting subject_identity_verification_required to False
Set FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED=False in environment variables or set subject_identity_verification_required = false in fides.toml
🧯 If You Can't Patch
- Disable subject identity verification feature entirely
- Implement network-level restrictions to limit Privacy Center access to trusted IP ranges only
🔍 How to Verify
Check if Vulnerable:
Check if Fides version is below 2.24.0 AND subject_identity_verification_required is set to True in configurationCheck Version:
fides --version or check the Fides web interface versionVerify Fix Applied:
Verify Fides version is 2.24.0 or higher and check that the random module is no longer used for OTP generation📡 Detection & Monitoring
Log Indicators:
- Multiple consecutive OTP generation attempts from single IP
- Unusual pattern of privacy/consent request submissions
Network Indicators:
- Bursts of requests to OTP generation endpoints
- Multiple failed OTP attempts followed by successful verification
SIEM Query:
source="fides" AND (event="otp_generated" OR event="privacy_request") | stats count by src_ip | where count > 100🔗 References
- https://github.com/ethyca/fides/commit/685bae61c203d29ed189f4b066a5223a9bb774c6
- https://github.com/ethyca/fides/security/advisories/GHSA-82vr-5769-6358
- https://peps.python.org/pep-0506/
- https://github.com/ethyca/fides/commit/685bae61c203d29ed189f4b066a5223a9bb774c6
- https://github.com/ethyca/fides/security/advisories/GHSA-82vr-5769-6358
- https://peps.python.org/pep-0506/
