CVE-2024-45053
📋 TL;DR
This CVE describes a Server-Side Template Injection vulnerability in Fides privacy platform's Email Templating feature. It allows privileged users (Owners or Contributors) to execute arbitrary code on the underlying Fides Webserver container. The vulnerability affects Fides versions 2.19.0 through 2.43.0.
💻 Affected Systems
- Fides
📦 What is this software?
Fides by Ethyca
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where an attacker gains full control of the Fides server, accesses sensitive privacy data, and potentially pivots to other systems in the environment.
Likely Case
Privileged user escalates their access to execute arbitrary commands on the Fides container, potentially accessing or modifying sensitive privacy data stored in the system.
If Mitigated
With proper access controls and monitoring, exploitation would be limited to authorized users only, but they could still execute arbitrary code on the server.
🎯 Exploit Status
Exploitation requires authenticated privileged user access. The vulnerability is in template rendering logic, making exploitation straightforward for knowledgeable attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.44.0
Vendor Advisory: https://github.com/ethyca/fides/security/advisories/GHSA-c34r-238x-f7qx
Restart Required: Yes
Instructions:
1. Backup your Fides configuration and data. 2. Stop the Fides service. 3. Update to version 2.44.0 or later using your deployment method (Docker, Kubernetes, etc.). 4. Restart the Fides service. 5. Verify the update was successful.
🧯 If You Can't Patch
- Restrict access to privileged roles (Owner/Contributor) to only trusted users.
- Disable the Email Templating feature if not required for your use case.
🔍 How to Verify
Check if Vulnerable:
Check your Fides version. If it's between 2.19.0 and 2.43.0 inclusive, you are vulnerable.Check Version:
docker exec fides-webserver fides --versionVerify Fix Applied:
After updating, verify the version is 2.44.0 or later and test that email templating functionality still works without allowing template injection.📡 Detection & Monitoring
Log Indicators:
- Unusual template rendering errors in Fides logs
- Suspicious email template modifications by privileged users
- Unexpected system commands executed from Fides process
Network Indicators:
- Unusual outbound connections from Fides container
- Suspicious payloads in email template API requests
SIEM Query:
source="fides" AND ("template" OR "jinja" OR "email_template") AND ("error" OR "exception" OR "exec")