CVE-2024-31223: Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
SERVER_SIDE_FIDES_API_URL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port.
This vulnerability allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL.
References
- github.com/advisories/GHSA-53q7-4874-24qg
- github.com/ethyca/fides
- github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097
- github.com/ethyca/fides/commit/cd510216b281de5443ec1c126add95cc5be0970a
- github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg
- nvd.nist.gov/vuln/detail/CVE-2024-31223
Code Behaviors & Features
Detect and mitigate CVE-2024-31223 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →