CVE-2024-45052
📋 TL;DR
This vulnerability allows unauthenticated attackers to determine valid usernames in Fides privacy platform by measuring timing differences in authentication responses. Attackers can use this information to conduct password brute-forcing or credential stuffing attacks. All Fides deployments prior to version 2.44.0 are affected.
💻 Affected Systems
- Fides
📦 What is this software?
Fides by Ethyca
⚠️ Risk & Real-World Impact
Worst Case
Attackers enumerate all valid usernames, then successfully brute-force passwords leading to full system compromise and privacy data exposure.
Likely Case
Attackers enumerate some usernames and conduct targeted password attacks, potentially gaining unauthorized access to user accounts.
If Mitigated
Attackers can enumerate usernames but cannot progress to password attacks due to strong authentication controls like MFA or rate limiting.
🎯 Exploit Status
Timing attacks require specialized tools but are well-documented. Attackers need network access to the Fides webserver.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.44.0
Vendor Advisory: https://github.com/ethyca/fides/security/advisories/GHSA-2h46-8gf5-fmxv
Restart Required: Yes
Instructions:
1. Backup your Fides configuration and data. 2. Stop the Fides service. 3. Update Fides to version 2.44.0 or later using your package manager or deployment method. 4. Restart the Fides service. 5. Verify the update was successful.
🧯 If You Can't Patch
- Implement network-level controls to restrict access to the Fides authentication endpoint to trusted IPs only.
- Deploy a WAF or reverse proxy with rate limiting and timing attack mitigation capabilities in front of Fides.
🔍 How to Verify
Check if Vulnerable:
Check if Fides version is below 2.44.0 by accessing the admin interface or checking deployment manifests.Check Version:
docker exec fides-webserver fides --version || check package manager versionVerify Fix Applied:
Confirm Fides version is 2.44.0 or higher and test authentication endpoints for consistent response times.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from single IPs
- Unusual patterns of authentication requests with varying usernames
Network Indicators:
- High volume of POST requests to /api/v1/login or similar authentication endpoints
- Requests with systematically varying usernames
SIEM Query:
source="fides" AND (url_path="/api/v1/login" OR action="authentication") | stats count by src_ip, username